bugtraq - QIP 2005 Denial of Service Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200902041438.n14EcSn0026605@www3.securityfocus.com>
Date: Wed, 4 Feb 2009 07:38:28 -0700
From: ss_contacts@...mail.com
To: bugtraq@...urityfocus.com
Subject: QIP 2005 Denial of Service Vulnerability

ShineShadow Security Report  04012009-07

TITLE

QIP 2005 Denial of Service Vulnerability

BACKGROUND

QIP 2005 is a freeware program with closed source, alternative instant messaging client based on the OSCAR protocol. It has full support of ICQ and experimental support of AIM.

Product website: www.qip.ru

VULNERABLE PRODUCTS

QIP 2005 build 8082 (latest build)
Previous versions may also be affected

DETAILS

Denial-of-service (DoS) vulnerability exists in QIP 2005 instant messenger software. An attacker could try to exploit the vulnerability by sending specially crafted message in RTF format to remote QIP client. The message could cause "freezing" the vulnerable application and using 100% CPU.
Exploit message example:
{\rtf\pict\&&}
Its remote exploitation vulnerability, no authentication or social engineering is required.
Probably vulnerable code exists in third party TRichView component that using QIP, but its not confirmed.

EXPLOITATION

Remote attacker can exploit this vulnerability using any instant messenger software with OSCAR (ICQ) protocol support by sending specialy crafted message in RTF format.

WORKAROUND

No workarounds

DISCLOSURE TIMELINE

29/01/2009 Initial vendor notification
30/01/2009 Vendor response
03/01/2009 New build has been released with same vulnerability
04/01/2009 Advisory released

CREDITS

Maxim Kulakov (aka ShineShadow)
ss_contacts@...mail.com