PT-2003-1456 · Mirabilis · Mirabilis Icq Pro

Daniel Benmergui + 3 · Published 2003-05-07 · Updated 2017-07-11 · CVE-2003-0239

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Mirabilis ICQ Pro version 2003a

Description: The issue concerns a denial of service that can be triggered by remote attackers. This is achieved through the icqateimg32.dll parsing/rendering library when it encounters malformed GIF89a headers. Specifically, the library is vulnerable when the headers do not contain a Global Color Table (GCT) or a Local Color Table (LCT) after an Image Descriptor.

Recommendations: For Mirabilis ICQ Pro version 2003a, consider disabling the icqateimg32.dll library as a temporary workaround to prevent the denial of service until a patch is available. Restrict access to GIF89a files to minimize the risk of exploitation. Avoid using the vulnerable library for parsing or rendering images until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-0239

Affected Products

Mirabilis Icq Pro

References · 6

• http://securityfocus.com/bid/7466 · Vendor Advisory
• http://coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0239 · Security Note
• http://marc.info/?l=bugtraq&m=105216842131995&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11948 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0051.html · Note