Vulnerable Packages: Mirabilis ICQ Pro 2003a & previous versions.
6 security vulnerabilities were found that could lead to various forms of exploitation ranging from denying users the ability to use ICQ services to execution of arbitrary commands on vulnerable systems. The following vulnerabilities were found:
POP3 Client Format String in UIDL Field.
"Subject" signed overflow in POP3 Client.
"Date" signed overflow in POP3 Client.
ICQ Features on Demand spoofing attack.
Message advertisements denial of service attack.
Input validation error in ICQ's GIF parsing/rendering library.
Vendors contacted:
- Mirabilis
We sent notifications mails to the following addresses: security@icq.com, secure@icq.com, webmaster@icq.com, support@icq.com, several times during March & April (2003-03-11, 2003-03-24, 2003-04-11) & never received an answer from Mirabilis.
Would you like to know more? Seems Mirabilis also attended the same classes as Microsoft on "How to handle security vulnerabilty reports for your products".