LICQ文件描述符远程拒绝服务漏洞

BUGTRAQ ID: 28679 CVECAN ID: CVE-2008-1996 Licq是基于linux qt的ICQ聊天客户端。 Licq在处理大量连接时存在漏洞，远程攻击者可能利用此漏洞导致Licq崩溃。 在运行时licq会在30000和65000之间的随机端口打开监听套接字。由于没有执行基于主机的认证，任何远程主机都可以连接。licq会在指定的超时后关闭这些连接。 如果远程用户创建了大量的入站TCP连接的话，则耗尽所有开放的文件描述符（大多数linux安装中非root用户为1024个）后，新的入站TCP连接请求就会导致licq崩溃。 LICQ 1.3.5 LICQ ----...

CVE-2008-1996

licq before 1.3.6 allows remote attackers to cause a denial of service file-descriptor exhaustion and application crash via a large number of connections...

CVE-2008-1996

licq before 1.3.6 allows remote attackers to cause a denial of service file-descriptor exhaustion and application crash via a large number of connections...

CVE-2008-1996

licq before 1.3.6 allows remote attackers to cause a denial of service file-descriptor exhaustion and application crash via a large number of connections...

CVE-2008-1996

CVE-2008-1996 affects licq prior to version 1.3.6, allowing remote attackers to cause a denial of service via a flood of connections (file-descriptor exhaustion and app crash). Public references confirm the issue and Fedora/SUSE advisories note fixes in later packages (e.g., licq 1.3.5–1.3.6+ in ...

openSUSE 10 Security Update : licq (licq-5214)

By starting more than 1024 connections against a remote licq client, attackers could cause licq to crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update licq-5214. The text description of thi...

licq fd_set bitmap index overflow

FDSETSIZE is not checked on incoming connection accept...

licq remote DoS?

Hello, Licq is a linux qt-based ICQ client. There is a vulnerability in the way licq processes new incoming TCP connections which can be exploited by a remote attacker to crash the client. When executed, licq opens a listening socket at a random port AFAIK between 30000 and 65000. There is no...

Re: licq remote DoS?

Dear Milen Rangelov, Actually, if number of sockets is not limited, it leads to worse situation of fdset structure index overflow. This problem is described here: http://securityvulns.ru/news4400.html in case of licq there is no check for socket number to be below FDSETSIZE and it leads to...

LICQ 1.3.5 - File Descriptor Remote Denial of Service

LICQ 1.3.5 - File Descriptor Remote Denial of Service // source: https://www.securityfocus.com/bid/28679/info LICQ is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions. A remote attacker can exploit this issue to crash the affected...

LICQ 1.3.5 - File Descriptor Remote Denial of Service

// source: https://www.securityfocus.com/bid/28679/info LICQ is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions. A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users. The...

CVE-2005-3141

Cerulean Studios Trillian 3.0 allows remote attackers to cause a denial of service crash via a reverse direct connection from a different client, as demonstrated using LICQ...

CVE-2003-0363

The CVE-2003-0363 entry covers a format string vulnerability in LICQ versions 1.2.6 and 1.0.3 (and possibly others). The underlying issue is a format string vulnerability in which an attacker can influence format specifiers to perform unknown actions remotely. The vulnerability affects LICQ’s han...

CVE-2003-0363

Format string vulnerability in LICQ 1.2.6, 1.0.3 and possibly other versions allows remote attackers to perform unknown actions via format string specifiers...

CVE-2003-0363

Format string vulnerability in LICQ 1.2.6, 1.0.3 and possibly other versions allows remote attackers to perform unknown actions via format string specifiers...

CVE-2002-0251

Buffer overflow in licq 1.0.4 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long string of format string characters such as "%d"...

CVE-2002-0251

CVE-2002-0251 affects licq 1.0.4 and earlier. The vulnerability is a buffer overflow triggered by a long format-string input (e.g., "%d"), allowing remote attackers to cause a crash and potentially execute arbitrary code. Impact is described as denial of service with possible code execution; expl...

CVE-2002-0251

Buffer overflow in licq 1.0.4 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long string of format string characters such as "%d"...

CVE-2001-0439

licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

CVE-2001-0439

CVE-2001-0439 affects Licq prior to 1.0.3. The vulnerability stems from how Licq parses received URLs: the URL is passed to the web browser via system() without sufficient input validation, allowing a remote attacker to inject shell metacharacters and execute arbitrary commands. Impact is remote ...