PT-2006-1607 · Cerulean · Cerulean Trillian

Published 2006-02-03 · Updated 2008-09-05 · CVE-2006-0543

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cerulean Trillian version 3.1.0.120

Description The issue allows remote attackers to cause a denial of service, resulting in a client crash, via an AIM message containing specific Mac encoded Rich Text Format (RTF) escape sequences, including 'd1, 'd2, 'd3, 'd4, and 'd5. These sequences can be accidentally sent by copying text from an OSX application and pasting it into the victim's client, causing the client to close immediately upon receiving such characters.

Recommendations For Cerulean Trillian version 3.1.0.120, as a temporary workaround, consider disabling the reception of AIM messages containing Mac encoded RTF character codes until a patch is available. Restrict access to the feature that allows the reception of such messages to minimize the risk of exploitation. Avoid using the affected RTF escape sequences in AIM messages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-0543

Affected Products

Cerulean Trillian

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2006-0543 · Security Note
• http://osvdb.org/22877 · Patch