Miranda IM EXT_YAHOO_CONTACT_ADDED Remote Format String Vulnerability

Bugtraq ID:	26389
Class:	Input Validation Error
CVE:	CVE-2007-5396
Remote:	Yes
Local:	No
Published:	Nov 09 2007 12:00AM
Updated:	Nov 09 2007 04:15PM
Credit:	Secunia Research is credited with the discovery of this issue.
Vulnerable:	Miranda Miranda IM 0.7.1
Not Vulnerable:

Miranda IM EXT_YAHOO_CONTACT_ADDED Remote Format String Vulnerability

Miranda IM is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application. Failed attempts may cause denial-of-service conditions.

The issue affects Miranda IM 0.7.1; other versions may also be vulnerable.

Miranda IM EXT_YAHOO_CONTACT_ADDED Remote Format String Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Miranda IM EXT_YAHOO_CONTACT_ADDED Remote Format String Vulnerability

Solution:
Fixes are available in the Miranda SVN repository. Please see the references for more information.

Miranda IM EXT_YAHOO_CONTACT_ADDED Remote Format String Vulnerability

References:

• Miranda ext_"yahoo_contact_added()" Format String Vulnerability (Secunia Research)
  
• Miranda IM Homepage (Miranda)
  
• Miranda IM v0.7.1 Released (Miranda)
  
• Miranda SVN repository (Miranda)