Trillian 3.1 basic nick crash

2008.05.03
Risk: Low
Local: Yes
Remote: Yes
CWE: CWE-119


Ogólna skala CVSS: 9.3/10
Znaczenie: 10/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Pełny
Wpływ na integralność: Pełny
Wpływ na dostępność: Pełny

I found a flaw in the trillian 3.1 for Windows. It is that on receipt of a nickname too long with some characters, this leads to break the program, the failure of the curious is that when the abri with ollydbg tries to read the argument of the message such as whether to wear the nickname long special characters and message write many letters "A" is the result Access violation when reading [41414141] The test is made using an account of MSN Messenger and I got a nick there till the limit of characters to the next character "?" (without the quotes) and send a message to another account that had msn in trillian. Anyway, is wrong with many more characters that is only one example ... Greetings! Juan Pablo Lopez Yacubian


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top