PT-2003-1566 · Icq · Icqlite

3Apa3A · Published 2003-06-05 · Updated 2016-10-18 · CVE-2003-0365

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: ICQLite version 2003a

Description: The issue allows local users to gain privileges as other users by replacing executables with malicious programs, due to the ICQ Lite directory being created with an Access Control Entry (ACE) for "Full Control" privileges for Interactive Users.

Recommendations: For ICQLite version 2003a, consider restricting access to the ICQ Lite directory to prevent local users from replacing executables with malicious programs. As a temporary workaround, monitor the directory for any suspicious activity and restrict the execution of any replaced executables until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-0365

Affected Products

Icqlite

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2003-0365 · Security Note
• http://marc.info/?l=bugtraq&m=105427404625027&w=2 · Note