Re: ICQ remote buffer overflow vulnerability

From: Daniel Tan (datan@seas.upenn.edu)
Date: 01/06/02 

Date: Sun, 06 Jan 2002 16:09:44 -0500
From: Daniel Tan <datan@seas.upenn.edu>
To: bugtraq@securityfocus.com

I've discovered that the same payload can be sent through Direct
Connection with the receiver, even with the DC settings set to
maximum (ie. allow only users on my contact list, allow DC
upon authorisation, do not allow older version of clients to DC).
If the sender is 'trusted' (ie. on the users' contact list), the
sender can establish a TCP connection with the users' listening
port even if DC settings are on maximum (in which case the
receiver's IP & port are not given to the sender, but one can
find this out in other ways eg. email header + port scan).

Whereas having the payload sent through the server allows a
possible remedy in having the server check for malformed packets,
being able to send the packet directly to the client takes away
that possibility.

Again, this works only for ICQ2000 clients.

-------------
Daniel Tan
Class of 2004
Jerome Fisher Management & Technology Program
University of Pennsylvania, USA
datan@seas.upenn.edu
datan@wharton.upenn.edu
-------------

Relevant Pages

  • Re: detection of analog CONNECT
    ... connection has been established. ... A modem on the other hand signals connect only after ... what is payload data and what is not. ... Try to emulate HDLC frames on the modem side. ...
    (comp.dcom.isdn.capi)
  • Re: Port Scanning.
    ... > The only thing that isn't currently easy to do is TCP full connection ... > payload injection from spoofed IP's. ... talking about in the last email was a way to actually introduce the TCP ... Robert E. Lee ...
    (Pen-Test)
  • Re: Which protocol?
    ... P.S. BTW PPP define you the way of connection but not reliability of ... The payload with be less than 15 bytes. ... I'm thinking about using PPP over a dial-up connection. ...
    (microsoft.public.win32.programmer.networks)
  • (exploit) firefox 1.5.0.6 linux DoS
    ... while ($client_addr = accept(CLIENT, SERVER)) { ... close connection ... print CLIENT $payload; ...
    (Bugtraq)