Two vulnerabilities have been reported in AOL AIM, which can be exploited by malicious people to compromise a user's system.

1) A signedness error in the SIP protocol implementation library (sipXtapi.dll) when parsing RTCP sender report packets can be exploited to cause a heap-based buffer overflow.

Successful exploitation may allow execution of arbitrary code, but requires that a user is tricked into accepting a Video Messaging session.

2) An error in sipXtapi.dll when parsing RTP information can be exploited to cause a heap-based buffer overflow via a specially crafted "Extension Length" RTP header value.

Successful exploitation may allow execution of arbitrary code, but requires that a user has an active voice session.

Solution
Update to version 6.8.7.7 or later.

Provided and/or discovered by
Reported by wushi of team509 via ZDI.

Original Advisory
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-08-097/
http://www.zerodayinitiative.com/advisories/ZDI-08-098/

Deep Links
Links available to Secunia VIM customers