Trillian Instant Messaging Credential Encryption Weakness

Bugtraq ID:	5677
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 09 2002 12:00AM
Updated:	Sep 09 2002 12:00AM
Credit:	Discovery of this issue is credited to Evan Nemerson <[email protected]>.
Vulnerable:	Cerulean Studios Trillian 0.6351 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Cerulean Studios Trillian 0.725 Cerulean Studios Trillian 0.73
Not Vulnerable:

Trillian Instant Messaging Credential Encryption Weakness

The following exploit was submitted by Evan Nemerson of The Coeus Group:

• /data/vulnerabilities/exploits/trillian-ini-decrypt.c

Trillian Instant Messaging Credential Encryption Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Trillian Instant Messaging Credential Encryption Weakness

References: