PT-2004-3264 · Yahoo+1 · Yahoo! Messenger+2

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2370

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Trillian versions 0.71 through 0.74f Trillian Pro versions 1.0 through 2.01

Description: A stack-based buffer overflow issue exists due to the improper handling of oversized packet key names in the Yahoo Messenger packet parser. This allows remote attackers to execute arbitrary code, resulting in a loss of confidentiality, integrity, and availability. The issue is triggered by a specially crafted request.

Recommendations: For Trillian versions 0.71 through 0.74f, update to a version outside of this range to resolve the issue. For Trillian Pro versions 1.0 through 2.01, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the Yahoo Messenger packet parser to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-2370

Produtos afetados

Trillian

Trillian Pro

Yahoo! Messenger

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2004-2370 · Nota de Segurança
• http://osvdb.org/4060 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017766.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15304 · Nota
• http://security.e-matters.de/advisories/022004.html · Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/15304 · Nota
• http://securitytracker.com/id?1009220 · Nota
• http://secunia.com/advisories/10973 · Aviso do Fabricante