PT-2004-3198 · America Online+1 · Aol Instant Messenger+2
Publicado
2004-12-31
·
Atualizado
2017-07-11
·
CVE-2004-2304
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Trillian versions 0.74 and earlier
Trillian Pro versions 2.01 and earlier
Description:
The issue is related to an integer overflow that allows remote attackers to cause a denial of service and possibly execute arbitrary code. This is achieved via a directIM packet that triggers a heap-based buffer overflow. The AOL Instant Messenger DirectIM parser fails to properly allocate a parsing buffer, resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution, leading to a loss of confidentiality, integrity, and/or availability.
Recommendations:
For Trillian versions 0.74 and earlier, consider upgrading to a version later than 0.74 to resolve the issue.
For Trillian Pro versions 2.01 and earlier, consider upgrading to a version later than 2.01 to resolve the issue.
As a temporary workaround, consider restricting access to the directIM packet parser to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Aol Instant Messenger
Trillian
Trillian Pro