Cerulean Studios Trillian Multiple Remote Buffer Overflow Vulnerabilities
BID:29330
Info
Cerulean Studios Trillian Multiple Remote Buffer Overflow Vulnerabilities
| Bugtraq ID: | 29330 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-2407 CVE-2008-2408 CVE-2008-2409 CVE-2009-2409 |
| Remote: | Yes |
| Local: | No |
| Published: | May 21 2008 12:00AM |
| Updated: | Jul 05 2016 09:38PM |
| Credit: | anonymous, tw33k, and n8 |
| Vulnerable: |
Cerulean Studios Trillian Pro 3.1.5 1 Cerulean Studios Trillian Pro 3.1.5 0 Cerulean Studios Trillian Pro 3.1 Cerulean Studios Trillian Pro 3.0 Cerulean Studios Trillian Pro 2.1 Cerulean Studios Trillian Pro 2.0 Cerulean Studios Trillian Pro 1.0 Cerulean Studios Trillian Pro 3.1.0 Build 121 Cerulean Studios Trillian Pro 2.01 Cerulean Studios Trillian 3.1.9 .0 Cerulean Studios Trillian 3.1.6 .0 Cerulean Studios Trillian 3.1.5 0 Cerulean Studios Trillian 3.1 Cerulean Studios Trillian 3.0 Cerulean Studios Trillian 2.1 Cerulean Studios Trillian 2.0 Cerulean Studios Trillian 1.0 Cerulean Studios Trillian 0.6351 Cerulean Studios Trillian 0.725 Cerulean Studios Trillian 0.74 i Cerulean Studios Trillian 0.74 Cerulean Studios Trillian 0.73 Cerulean Studios Trillian 0.71 Cerulean Studios Trillian 3.1.7.0 Cerulean Studios Trillian 3.1.6.0 Cerulean Studios Trillian 3.1.5.1 Baltimore Technologies MAILsweeper for SMTP 0.74 Patch B |
| Not Vulnerable: |
Cerulean Studios Trillian Pro 3.1.10 .0 Cerulean Studios Trillian 3.1.10 .0 |
Discussion
Cerulean Studios Trillian Multiple Remote Buffer Overflow Vulnerabilities
Trillian is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.
Remote attackers can exploit these issues to execute arbitrary code with the privileges of the user running the application.
Versions prior to Trillian 3.1.10.0 are vulnerable.
Trillian is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.
Remote attackers can exploit these issues to execute arbitrary code with the privileges of the user running the application.
Versions prior to Trillian 3.1.10.0 are vulnerable.
Exploit / POC
Cerulean Studios Trillian Multiple Remote Buffer Overflow Vulnerabilities
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Cerulean Studios Trillian Multiple Remote Buffer Overflow Vulnerabilities
Solution:
The vendor released Trillian v3.1.10.0 to address these issues. Please see the references for more information.
Cerulean Studios Trillian 3.1.5.1
Cerulean Studios Trillian 3.1.7.0
Cerulean Studios Trillian Pro 2.01
Cerulean Studios Trillian 3.1.6.0
Cerulean Studios Trillian Pro 3.1.0 Build 121
Cerulean Studios Trillian 0.6351
Cerulean Studios Trillian 0.71
Cerulean Studios Trillian 0.725
Cerulean Studios Trillian 0.73
Cerulean Studios Trillian 0.74
Cerulean Studios Trillian 0.74 i
Baltimore Technologies MAILsweeper for SMTP 0.74 Patch B
Cerulean Studios Trillian Pro 1.0
Cerulean Studios Trillian 1.0
Cerulean Studios Trillian 2.0
Cerulean Studios Trillian Pro 2.0
Cerulean Studios Trillian Pro 2.1
Cerulean Studios Trillian 2.1
Cerulean Studios Trillian Pro 3.0
Cerulean Studios Trillian 3.0
Cerulean Studios Trillian 3.1
Cerulean Studios Trillian Pro 3.1
Cerulean Studios Trillian Pro 3.1.5 1
Cerulean Studios Trillian 3.1.5 0
Cerulean Studios Trillian Pro 3.1.5 0
Cerulean Studios Trillian 3.1.6 .0
Cerulean Studios Trillian 3.1.9 .0
Solution:
The vendor released Trillian v3.1.10.0 to address these issues. Please see the references for more information.
Cerulean Studios Trillian 3.1.5.1
Cerulean Studios Trillian 3.1.7.0
Cerulean Studios Trillian Pro 2.01
Cerulean Studios Trillian 3.1.6.0
Cerulean Studios Trillian Pro 3.1.0 Build 121
Cerulean Studios Trillian 0.6351
Cerulean Studios Trillian 0.71
Cerulean Studios Trillian 0.725
Cerulean Studios Trillian 0.73
Cerulean Studios Trillian 0.74
Cerulean Studios Trillian 0.74 i
Baltimore Technologies MAILsweeper for SMTP 0.74 Patch B
Cerulean Studios Trillian Pro 1.0
Cerulean Studios Trillian 1.0
Cerulean Studios Trillian 2.0
Cerulean Studios Trillian Pro 2.0
Cerulean Studios Trillian Pro 2.1
Cerulean Studios Trillian 2.1
Cerulean Studios Trillian Pro 3.0
Cerulean Studios Trillian 3.0
Cerulean Studios Trillian 3.1
Cerulean Studios Trillian Pro 3.1
Cerulean Studios Trillian Pro 3.1.5 1
Cerulean Studios Trillian 3.1.5 0
Cerulean Studios Trillian Pro 3.1.5 0
Cerulean Studios Trillian 3.1.6 .0
Cerulean Studios Trillian 3.1.9 .0
References
Cerulean Studios Trillian Multiple Remote Buffer Overflow Vulnerabilities
References:
References:
- CVE-2009-2409 Cryptographic Issues in OpenSSL (Oracle)
- Trillian Homepage (Cerulean Studios)
- ZDI-08-029: Trillian AIM.DLL Long HTML Font Parameter Stack Overflow Vulnerabili ([email protected])
- ZDI-08-030: Trillian Multiple Protocol XML Parsing Memory Corruption Vulnerabili ([email protected])
- ZDI-08-031: Trillian MSN MIME Header Stack-Based Overflow Vulnerability ([email protected])
- Trillian AIM.DLL Long HTML Font Parameter Stack Overflow Vulnerability (Zero Day Initiative)
- Trillian MSN MIME Header Stack-Based Overflow Vulnerability (Zero Day Initiative)
- Trillian Multiple Protocol XML Parsing Memory Corruption Vulnerability (Zero Day Initiative)