Adam Gartenberg's Blog

Business Analytics and Optimization, IBM and Social Marketing

If you use AOL or Yahoo Messenger, keep an eye out for security patches


For those using AOL or Yahoo Messenger, a good reminder to make sure you stay up to date on your client patches:

The Register:  Yahoo! in ninth circle of security hell

Trouble came in pairs for instant messenger users this week with the disclosure of unpatched flaws in chat software from both AOL and Yahoo!
...
A security bug in Yahoo!'s IM client reportedly makes it possible for crackers to download arbitrary files - potentially malware - onto the PCs of prospective marks. Whether it's possible to get this code to run depends on a user's Internet Explorer security settings, a factor that mitigates against the potency of the attack.
...
Security firm nCircle describes the bug as the ninth zero-day threat against Messenger this year, PC World reports.

By comparison, the AOL instant message bug is a walk in the park. Hackers might be able to send script in specifically malformed messages to other users. Marks would either need to already be friends with the hackers or accept arbitrary messages for the attack to be effective, Secunia reports.