ICQ For MacOS X Client Denial Of Service Vulnerability
BID:4031
Info
ICQ For MacOS X Client Denial Of Service Vulnerability
| Bugtraq ID: | 4031 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 05 2002 12:00AM |
| Updated: | Feb 05 2002 12:00AM |
| Credit: | This vulnerability was submitted to BugTraq on February 5th, 2002 by Stephen <[email protected]>. |
| Vulnerable: |
Mirabilis ICQ For MacOS X 2.6 X Beta |
| Not Vulnerable: | |
Discussion
ICQ For MacOS X Client Denial Of Service Vulnerability
ICQ For MacOS X is a port of the popular Mirabilis ICQ client to the Apple MacOS X platform. It is freely available.
It is possible to cause MacOS X ICQ clients to crash by sending an excessively long request (19000+ characters). MacOS X ICQ clients normally bind to ports 49152 and 49159.
This is likely due to an unchecked buffer of some sort, so the possibility of exploiting this condition to execute arbitrary attacker-supplied instructions does exist. Though this possibility has not been confirmed.
This issue has been reported for ICQ For MacOS X version 2.6X Beta. Other versions may also be prone to this issue.
ICQ For MacOS X is a port of the popular Mirabilis ICQ client to the Apple MacOS X platform. It is freely available.
It is possible to cause MacOS X ICQ clients to crash by sending an excessively long request (19000+ characters). MacOS X ICQ clients normally bind to ports 49152 and 49159.
This is likely due to an unchecked buffer of some sort, so the possibility of exploiting this condition to execute arbitrary attacker-supplied instructions does exist. Though this possibility has not been confirmed.
This issue has been reported for ICQ For MacOS X version 2.6X Beta. Other versions may also be prone to this issue.
Exploit / POC
ICQ For MacOS X Client Denial Of Service Vulnerability
Proof-of-concept was submitted by Stephen <[email protected]>.
Proof-of-concept was submitted by Stephen <[email protected]>.
Solution / Fix
ICQ For MacOS X Client Denial Of Service Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.