Re: [Full-disclosure] ICQ 6 protocol bug?



Valdis.Kletnieks@xxxxxx wrote:
On Sat, 14 Feb 2009 23:26:48 +0200, James Matthews said:


ICQ is known to have a few remote bugs. I use meebo.com instead of a client
due to these issues.


At which point you're probably trading known bugs for unknown bugs. ;)

Of course, this is a battle the user can't win. The other option is to
toss the proprietary ICQ client and use some other open-source client like
Pidgin - at which point you're trading known ICQ bugs for unknown Pidgin bugs.
At that point, your best bet is to consider 2 things:

1) What client am I most likely to see actual attacks against?
2) What client am I the most worried about attacks?

(Note the two don't have to be the same - widespread ICQ attacks may be more
common, but maybe you worry more about getting hit with a Pidgin attack because
it possibly means you're being targeted....)


Pidgin seems to spontaneously self combust without it being attacked.
Which is just a little bit more disruptive.

So there's the trade off: do i worry about attacks or worry about my
conversation being randomly disrupted?

But in summary, nobody seems to know of anything new, so I need
to watch the icq traffic with wireshark to see what's what.

At the very least, messages from unknown parties can be ignored
and it seems to be the rendering(again!) that has caused problems.

Darren

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/