bugtraq - Trillian 3.1.9.0 DTD File Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080411164624.15487.qmail@securityfocus.com>
Date: 11 Apr 2008 16:46:24 -0000
From: david130490@...mail.com
To: bugtraq@...urityfocus.com
Subject: Trillian 3.1.9.0 DTD File Buffer Overflow

Name:
Trillian 3.1.9.0 DTD File Buffer Overflow

Software:
Trillian 3.1.9.0

Vendor:
Cerulean Studios

Description:
Trillian 3.1.9.0. Basic(and maybe minor versions and other as Pro) is vulnerable to parser xml format in .dtd file type. The explotation requires that the user download a malformed file and installed in a stixe directory and others. The bug is a function that parse .dtd files with SYSTEM and file identifier.

Web:
http://www.ceruleanstudios.com/

Download a poc file:
http://www.p1mp4m.es/index.php?act=attach&type=post&id=18