ICQ vulnerable to account theft using JavaScripts

In security advisories for ICQ (http://noptrix.net/advisories/icq_cli_xss.txt)and the ICQ web site (http://noptrix.net/advisories/icq_web_xss.txt), security researcher Levent Kayan warns that both the ICQ instant messenger for Windows and the ICQ web site contain vulnerabilities that potentially allow attackers to take control of a user's ICQ account. According to Kayan ICQ doesn't adequately check user's profile information and fails properly to analyse status messages, which can be freely chosen by users, to see if they contain executable code. Kayan recently discovered a similar hole in the Skype client.

Heise Security was able to reproduce the flaw discovered by Kayan using the current 7.5 version of ICQ. ICQ told that it was in the process of developing and testing a security fix.

Via: HNN