[ http://www.rootshell.com/ ]
From zallison@rice.edu Thu Aug 13 22:34:42 1998
Date: Thu, 13 Aug 1998 23:25:49 -0300
From: zack
To: kit@rootshell.com
Subject: Major ICQ security hole.
Greetings...
I code a linux ICQ clone, and after one of my users mistyped his
password, and was allowed into his account anyway. After further
investivating, this is what I found.
* It is possible to log in to the ICQ servers as ANYONE without having
to know their password. This leads to all sorts of comprimises. This
is *not* simply spoofing
How it works:
The mirabilis server uses a password of 8 chars. Their clients do the
range checking and only send in passwords of 8 or less chars. The Linux
clones, mine in particular, don't do this.
* When a password of 9 or more characters is sent, their buffer is
over-run, and it allows you to log in.
The exploit:
Download any ICQ clone (example: http://hookah.ml.org/zicq)
Set the UIN to be the targets UIN
Set the password to "123456789" <-- Just large enough to overflow
Start the ICQ program. If all goes well, it will log in and connect, as
that user. Any waiting (offline) messages will be delivered to you.
You can now send _and_ recieve messages and URLS as the client allows.
Notes:
This is NOT spoofing, you are actually logged in as the selected UIN.
Unlike spoofing you can recieve messages as well.
All UINS will work, as long as someone is not already logged in with
that UIN.
Mirabilis / AOL really needs to fix this problem.
Zack
(
geocities.com/dharan6/library) (
geocities.com/dharan6)