Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: ICQ 6 protocol bug?
From: Darren Reed <darrenr () fastmail net>
Date: Wed, 18 Feb 2009 09:35:03 -0800

Valdis.Kletnieks () vt edu wrote:
On Sat, 14 Feb 2009 23:26:48 +0200, James Matthews said:

ICQ is known to have a few remote bugs. I use meebo.com instead of a client
due to these issues.

At which point you're probably trading known bugs for unknown bugs. ;)

Of course, this is a battle the user can't win. The other option is to
toss the proprietary ICQ client and use some other open-source client like
Pidgin - at which point you're trading known ICQ bugs for unknown Pidgin bugs.
At that point, your best bet is to consider 2 things:

1) What client am I most likely to see actual attacks against?
2) What client am I the most worried about attacks?

(Note the two don't have to be the same - widespread ICQ attacks may be more
common, but maybe you worry more about getting hit with a Pidgin attack because
it possibly means you're being targeted....)

Pidgin seems to spontaneously self combust without it being attacked.
Which is just a little bit more disruptive.

So there's the trade off: do i worry about attacks or worry about my
conversation being randomly disrupted?

But in summary, nobody seems to know of anything new, so I need
to watch the icq traffic with wireshark to see what's what.

At the very least, messages from unknown parties can be ignored
and it seems to be the rendering(again!) that has caused problems.


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]