====================================================================== 

                     Secunia Research 18/08/2006

          - AOL Insecure Default Directory Permissions -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
Vendor Statement.....................................................8
References...........................................................9
About Secunia.......................................................10
Verification........................................................11

====================================================================== 
1) Affected Software 

AOL 9.0 Security Edition revision 4184.2340.

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Less critical 
Impact: Privilege Escalation, Manipulation of Data
Where:  Local System

====================================================================== 
3) Vendor's Description of Software 

Product Link:
http://downloads.channel.aol.com/windowsproducts

====================================================================== 
4) Description of Vulnerability

Secunia Research has discovered a security issue in AOL, which can be
exploited by malicious, local users to manipulate arbitrary files.

The problem is that AOL sets insecure default permissions (grants 
"Everyone" group "Full Control") on the "America Online 9.0" directory
and all child objects. This can be exploited to remove, manipulate, 
and replace any of the application's files.

====================================================================== 
5) Solution 

The vendor has issued an updated version (see the vendor statement).

====================================================================== 
6) Time Table 

09/02/2006 - Vendor notified.
09/02/2006 - Vendor response.
18/08/2006 - Public disclosure.

====================================================================== 
7) Credits 

Discovered by Carsten Eiram, Secunia Research.

====================================================================== 
8) Vendor Statement

Overview

AOL has recently been made aware of a local security vulnerability in
the AOL client software.  Upon installation, folders containing the 
AOL software retain local file permissions such that any local user 
may be able to overwrite files within the AOL program directories. 
A malicious user may be able to overwrite legitimate AOL software with
malicious code, thereby escalating their local privileges if a
privileged user were to unknowingly execute the user's software.

Affected Products and Applications

The following AOL software versions are affected by this issue:

* All versions of the AOL client

Solutions

1.  AOL Members using AOL 9.0 may simply log on to AOL and a fix will
be seamlessly applied to their system.

2.  AOL Members using earlier versions of the AOL client are 
recommended to upgrade to AOL 9.0 Security Edition

Acknowledgements

AOL would like to thank Secunia for their assistance in responsibly
addressing this issue.

======================================================================

9) References

The Common Vulnerabilities and Exposures (CVE) project has assigned 
candidate number CVE-2006-0948 for the vulnerability.

====================================================================== 
10) About Secunia 

Secunia collects, validates, assesses, and writes advisories regarding 
all the latest software vulnerabilities disclosed to the public. These 
advisories are gathered in a publicly available database at the 
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all 
relevant vulnerability information to their specific system 
configuration. 

Secunia offers a FREE mailing list called Secunia Security Advisories: 

http://secunia.com/secunia_security_advisories/

====================================================================== 
11) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-08/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================