Trillian Overly Long Nickname Remote Denial Of Service Vulnerability

Bugtraq ID:	28925
Class:	Boundary Condition Error
CVE:	CVE-2008-2008
Remote:	Yes
Local:	No
Published:	Apr 24 2008 12:00AM
Updated:	May 07 2015 05:29PM
Credit:	Juan Pablo Lopez Yacubian
Vulnerable:	Cerulean Studios Trillian Pro 3.1 Cerulean Studios Trillian 3.1
Not Vulnerable:	Cerulean Studios Trillian 3.1.10 .0

Trillian Overly Long Nickname Remote Denial Of Service Vulnerability

Trillian is prone to a remote denial-of-service vulnerability because it fails to sufficiently bounds-check user-supplied data.

Few details regarding this vulnerability are available; we will update this BID when more information emerges.

Exploiting this issue allows remote attackers to trigger denial-of-service conditions, denying further service to legitimate users.

Trillian 3.1 is vulnerable; other versions may also be affected.

Trillian Overly Long Nickname Remote Denial Of Service Vulnerability

Attackers can exploit this issue by creating overly long nicknames for MSN Messenger accounts.

Trillian Overly Long Nickname Remote Denial Of Service Vulnerability

Solution:
The vendor has released an update to address this issue. Contact the vendor for details on obtaining and applying the appropriate updates.

Trillian Overly Long Nickname Remote Denial Of Service Vulnerability

References:

• Trillian Homepage (Cerulean Studios)
  
• Trillian 3.1 basic nick crash ([email protected])