PT-2008-2716 · Mirabilis+1 · Mirabilis Icq+1

B0B · Published 2008-03-03 · Updated 2011-03-08 · CVE-2008-1120

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mirabilis ICQ versions earlier than 6 Build 6059

Description The issue is related to a format string vulnerability in the embedded Internet Explorer component. This vulnerability can be triggered when processing HTML messages with a format string specifier, such as %020000000p. If a remote attacker can trick a user into viewing a malicious message, they may be able to crash the application or execute arbitrary code on the remote host, subject to the user's privileges.

Recommendations For versions earlier than 6 Build 6059, update to version 6 Build 6059 or later to resolve the issue. As a temporary workaround, consider avoiding the use of HTML messages with format string specifiers until the issue is resolved. Restrict access to potentially malicious messages to minimize the risk of exploitation.

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2008-1120

Affected Products

Internet Explorer

Mirabilis Icq

References · 6

• http://secunia.com/advisories/29138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1120 · Security Note
• http://frsirt.com/english/advisories/2008/0701 · Note
• http://securityfocus.com/bid/28027 · Note
• http://board.raidrush.ws/showthread.php?t=386983 · Note
• http://vupen.com/english/advisories/2008/0701 · Note