LICQ Format String Denial Of Service Vulnerability
BID:4036
Info
LICQ Format String Denial Of Service Vulnerability
| Bugtraq ID: | 4036 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 06 2002 12:00AM |
| Updated: | Feb 06 2002 12:00AM |
| Credit: | This vulnerability was submitted to BugTraq on February 6th, 2002 by <[email protected]>. |
| Vulnerable: |
LICQ LICQ 1.0.4 LICQ LICQ 1.0.3 LICQ LICQ 1.0.2 LICQ LICQ 1.0.1 LICQ LICQ 1.0 |
| Not Vulnerable: | |
Discussion
LICQ Format String Denial Of Service Vulnerability
LICQ is a freely available, open-source ICQ client for variants of Unix and Linux operating systems.
LICQ is prone to denial of service attacks. Excessively long requests containing format strings such as %d will cause the client to crash. The LICQ crashes when sent 1024+ bytes.
Due to the nature of this issue, it may be possible to leverage this vulnerability to cause arbitrary attacker-supplied instructions to be executed on a host running the vulnerable software. Though this possibility has not been confirmed.
LICQ is a freely available, open-source ICQ client for variants of Unix and Linux operating systems.
LICQ is prone to denial of service attacks. Excessively long requests containing format strings such as %d will cause the client to crash. The LICQ crashes when sent 1024+ bytes.
Due to the nature of this issue, it may be possible to leverage this vulnerability to cause arbitrary attacker-supplied instructions to be executed on a host running the vulnerable software. Though this possibility has not been confirmed.
Exploit / POC
LICQ Format String Denial Of Service Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
LICQ Format String Denial Of Service Vulnerability
Solution:
The vendor has confirmed this issue and an upgrade is available via CVS. No official patch is available for download via the LICQ website.
Solution:
The vendor has confirmed this issue and an upgrade is available via CVS. No official patch is available for download via the LICQ website.