URI injection threat spreads to Trillian (and others)

It looks like a lot of applications don't sanitize/validate their Uniform Resource Identifier (URI) data coming in from other programs. First victim was the firefoxurl URI handler, and now it looks like the Trillian AIM URI handler is next.

Read about it more here. I suspect we are going to be seeing a lot of exploits and exploitable programs unfold in the following weeks, unfortunately.

I don't know the inner details of the URI passing mechanisms but it seems to be a mix of design oversight and programs not validating their input. Expect a lot more fingerpointing.