Core Security Technologies Discovers Multiple Vulnerabilities in AOL's Popular ICQ Messaging Software.

BOSTON -- With Upwards of 160 Million Users Potentially Affected, Vulnerabilities Allow Attackers to Exploit Holes in Popular Online Chat Software and Take Over User Machines

Core Security Technologies, provider of CORE IMPACT, the first-to-market penetration testing product for assessing specific information security risks, today issued advisories disclosing multiple vulnerabilities that could severely impact the more than 160 million registered users of America Online's ICQ global instant-messaging service. Researchers from CoreLabs, the research arm of Core Security, discovered that, by exploiting these vulnerabilities, an attacker could execute code and take control of a user's computer. AOL recommends that ICQ users immediately upgrade to ICQ version 5.1 to protect themselves from exploitation. Specifically, the vulnerabilities affect:

--ICQ Pro 2003b Build #3916 and previous versions: The ICQ Pro2003b client works with AOL's Instant Messenger (AIM) and AOL services. The latest version of ICQ Pro 2003b, Build #3916, was released in October 2005 and is still available for download from ICQ's Web site.

--ICQ Toolbar 1.3 for Internet Explorer: This toolbar provides several features, including search, pop-up blocker, ICQmail notifier and RSS feeds. The toolbar is one of the various products offered by ICQ and it is currently available for download at ICQ.com.

"These vulnerabilities could present a significant security risk to millions of ICQ users and it is essential that users take the appropriate steps to ensure that they are properly protected. This is a good example of why client-side vulnerabilities in desktop software are a real and present danger that should be identified and addressed diligently," said Ivan Arce, CTO at Core Security Technologies.

Vulnerability Specifics:

AOL ICQ Pro 2003b heap overflow vulnerability--CoreLabs researchers uncovered a vulnerability in the way the ICQ Pro 2003b client handles incoming message lengths that could lead to denial of service attacks and remote compromise of systems running vulnerable versions of the client. Attacks that leverage this vulnerability would be difficult to identify and isolate as exploit traffic does not present any features that makes it easily distinguishable from normal IM communications.

In response, the AOL Product Vulnerabilities team provided the following statement: "AOL has recently been made aware of a vulnerability in the ICQ 2003b client build #3916. Successful exploitation of the vulnerability may allow an attacker to remotely execute commands. AOL and ICQ recommend that users upgrade to the latest version of the ICQ client: ICQ 5.1."

Multiple vulnerabilities in ICQ Toolbar 1.3 for Internet Explorer--CoreLabs also discovered a problem in the way the ICQ Toolbar implements its Web configuration interface, which enables attackers controlling a malicious Web site to change the ICQ Toolbar's configuration settings without users of the ICQ Toolbar noticing. Additionally, cross-site scripting vulnerabilities in the toolbar's RSS Feeds interface could allow malicious RSS feeds to execute scripting code in the context of the Feeds interface, and allow attackers to access (and, in specific cases, change) configuration settings.

In response to the remote configuration vulnerability, AOL Product Vulnerabilities team recommends that users carefully inspect the source of any Web-based files they use to configure their ICQ Toolbar. To address the malicious RSS feed vulnerability, it recommends that users download ICQ Toolbar 1.2, which is packaged with ICQ 5.1 and does not have the RSS feed capability.

For more information on both vulnerabilities and the systems affected, please visit: http://www.coresecurity.com/common/showdoc.php?idx=583&idxseccion=10 and http://www.coresecurity.com/common/showdoc.php?idx=584&idxseccion=10

About CoreLabs

CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. Research is conducted in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing and cryptography. Results from these efforts include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies.

CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://www.coresecurity.com/corelabs/

About Core Security Technologies

Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide develop and maintain a proactive process for securing their networks. The company's flagship product, CORE IMPACT, is the first automated penetration testing product for assessing specific information security threats to an organization. Penetration testing evaluates overall network security and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core augments its leading technology solution with world-class security consulting services, including penetration testing, software security auditing and related training. Based in Boston, MA and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com.