Original URL: http://www.theregister.co.uk/2011/07/28/icq_scripting_bug/
Naughty JavaScript can be planted in IM status messages
Technique shown for ICQ as well as Skype
Posted in Security, 28th July 2011 12:28 GMT
Free whitepaper – Hands on with Hyper-V 3.0 and virtual machine movement
Security shortcomings in both ICQ instant messenger for Windows and the ICQ website create a possible mechanism for account hijacking, a security researcher warns [1].
Levent Kayan warns that the software fails to screen against the inclusion of JavaScript code in user-supplied status messages. The shortcoming means that this JavaScript code might be run on a victim's machine providing they are tricked into opening the booby-trapped status message using a vulnerable ICQ client.
The technique might be used to steal session cookies, enabling the hijacker to impersonate victims, or (with greater difficulty) to gain access to local files on a compromised PC. Kayan found a similar [2] cross-site scripting flaw involving Skype earlier this month.
Heise Security was able to reproduce the flaw discovered by Kayan using the current 7.5 version of ICQ. ICQ told [3] the security news site that it was in the process of developing and testing a security fix. ®