Vulnerabilities > CVE-2008-1120 - USE of Externally-Controlled Format String vulnerability in ICQ Mirabilis ICQ 6

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
icq
CWE-134
critical
nessus
NVD
Published: 2008-03-03
Updated: 2011-03-08

Summary

Format string vulnerability in the embedded Internet Explorer component for Mirabilis ICQ 6 build 6043 allows remote servers to execute arbitrary code or cause a denial of service (crash) via unspecified vectors related to HTML code generation.

Vulnerable Configurations

Part Description Count
Application
Icq
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Format String Injection
    An attacker includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An attacker can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the attacker can write to the program stack.
  • String Format Overflow in syslog()
    This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.

Nessus

NASL familyWindows
NASL idICQ_6_0_0_6059.NASL
descriptionThe version of ICQ installed on the remote host is earlier than 6 Build 6059. Such versions reportedly are affected by a format string vulnerability in the embedded Internet Explorer component triggered when processing HTML messages with a format string specifier such as
last seen2020-06-01
modified2020-06-02
plugin id34948
published2008-11-24
reporterThis script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/34948
titleICQ < 6 Build 6059 Message Processing Format String
code
#
# (C) Tenable Network Security, Inc.
#



include("compat.inc");

if (description)
{
  script_id(34948);
  script_version("1.10");

  script_cve_id("CVE-2008-1120");
  script_bugtraq_id(28027);
  script_xref(name:"Secunia", value:"29138");
  
  script_name(english:"ICQ < 6 Build 6059 Message Processing Format String");
  script_summary(english:"Checks ICQ version");

 script_set_attribute(attribute:"synopsis", value:
"The remote host contains a chat client that is affected by a remote
format string vulnerability." );
 script_set_attribute(attribute:"description", value:
"The version of ICQ installed on the remote host is earlier than 6
Build 6059.  Such versions reportedly are affected by a format string
vulnerability in the embedded Internet Explorer component triggered
when processing HTML messages with a format string specifier such as
'%020000000p'.  If a remote attacker can trick a user on the remote
host into viewing a message with the affecting application, he may be
able to leverage this issue to crash the affected application or to
execute arbitrary code on the remote host subject to the user's
privileges." );
 script_set_attribute(attribute:"see_also", value:"http://keksa.de/?q=icqstory" );
 script_set_attribute(attribute:"see_also", value:"https://raidrush.net/threads/icq6-user-crashen-format-string-vulnerability.386983/" );
 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5251565e" );
 script_set_attribute(attribute:"solution", value:
"Upgrade to ICQ 6 build 6059 (6.0.0.6059) or later as that reportedly
addresses the issue." );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
 script_cwe_id(134);
 script_set_attribute(attribute:"plugin_publication_date", value: "2008/11/24");
 script_cvs_date("Date: 2018/11/15 20:50:27");
script_set_attribute(attribute:"plugin_type", value:"local");
script_end_attributes();


  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("icq_installed.nasl");
  script_require_keys("SMB/ICQ/Version");

  exit(0);
}


include("global_settings.inc");


product = get_kb_item("SMB/ICQ/Product");
if (isnull(product)) product = "ICQ";

version = get_kb_item("SMB/ICQ/Version");
if (isnull(version)) exit(0);

ver = split(version, sep:'.', keep:FALSE);
for (i=0; i<max_index(ver); i++)
  ver[i] = int(ver[i]);

if (
  ver[0] < 6 || 
  (ver[0] == 6 && ver[1] == 0 && ver[2] == 0 && ver[3] < 6059)
)
{
  if (report_verbosity)
  {
    report = string(
      "\n",
      product, " ", version, " is currently installed on the remote host.\n"
    );
    security_hole(port:get_kb_item("SMB/transport"), extra:report);
  }
  else security_hole(get_kb_item("SMB/transport"));
}

References