Mirabilis ICQ File Transfer Extension Hiding Vulnerability

Bugtraq ID:	16655
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 15 2006 12:00AM
Updated:	Feb 15 2006 06:52PM
Credit:	Discovered by <[email protected]>.
Vulnerable:	Mirabilis ICQ Lite 4.1 Mirabilis ICQ Lite 4.0 Mirabilis ICQ 2003 b Mirabilis ICQ 2003 a
Not Vulnerable:

Mirabilis ICQ File Transfer Extension Hiding Vulnerability


Mirabilis ICQ is prone to an issue that could allow the file extension of a transferred file to be hidden. This could allow an attacker to send an executable file to a vulnerable user while claiming that the file is innocuous.

ICQ 2003 and ICQ Lite 4.0 and 4.1 are reportedly affected by this issue. Other versions may be vulnerable.

Mirabilis ICQ File Transfer Extension Hiding Vulnerability


An exploit is not required.

Mirabilis ICQ File Transfer Extension Hiding Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Mirabilis ICQ File Transfer Extension Hiding Vulnerability

References:

• ICQ Homepage (Mirabilis)
  
• Mirabiliz ICQ 2002/2003/ LITE 4.0/4.1 LONG (DIRECTORY + FILENAME) EXPLOIT ([email protected])