PT-2008-2716 · Mirabilis+1 · Mirabilis Icq+1

B0B · Publicado 2008-03-03 · Atualizado 2011-03-08 · CVE-2008-1120

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mirabilis ICQ versions earlier than 6 Build 6059

Description The issue is related to a format string vulnerability in the embedded Internet Explorer component. This vulnerability can be triggered when processing HTML messages with a format string specifier, such as %020000000p. If a remote attacker can trick a user into viewing a malicious message, they may be able to crash the application or execute arbitrary code on the remote host, subject to the user's privileges.

Recommendations For versions earlier than 6 Build 6059, update to version 6 Build 6059 or later to resolve the issue. As a temporary workaround, consider avoiding the use of HTML messages with format string specifiers until the issue is resolved. Restrict access to potentially malicious messages to minimize the risk of exploitation.

Correção

DoS

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2008-1120

Produtos afetados

Internet Explorer

Mirabilis Icq

Referências · 6

• http://frsirt.com/english/advisories/2008/0701 · Nota
• http://secunia.com/advisories/29138 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-1120 · Nota de Segurança
• http://securityfocus.com/bid/28027 · Nota
• http://board.raidrush.ws/showthread.php?t=386983 · Nota
• http://vupen.com/english/advisories/2008/0701 · Nota