Highly critical vulnerability in Trillian

Juan Pablo Lopez Yacubian found a highly critical flaw in the popular Trillian chat client that supports AIM, ICQ, MSN, Yahoo Messenger, and IRC.

Secunia: the vulnerability is caused due to an error within the processing of “Display Names” in messages. This can be exploited to cause a memory corruption by e.g. setting the “Display Name” to a specially crafted, overly long string and sending an overly long message to another user using the MSN protocol.

The flaw affect Trillian Basic v3.x and Trillian Pro v3.x

At the moment of writing this vulnerability is still unpatched so take care and add only trusted users to the contact list!

Source: Neohapsis

April 27, 2008 - Posted by Smokey | Advisories, Alerts, Downloads, News, Recommended External Security Related Links, Vulnerabilities | aim, flaw Trillian chat client, highly critical, icq, Juan Pablo Lopez Yacubian, MSN Messenger, nick crash, nickname, trillian basic, trillian pro, unpatched, vulnerability, yahoo messenger

No comments yet.

Introduction

__________________________________________

Text from the song Spark by Amy Macdonald

I am the light in the dark
I am the march
I am the spark

Just dry your tears and I’ll be there
Don’t live for anger all this pain
Don’t worry, I’m ok, I’m ok now

Always in our hearts – R.I.P. Donna Buenaventura

__________________________________________

.
Welcome to Smokey’s Security Weblog!

Let’s introduce myself: my (nick)name is Smokey aka Smokey Bear.

Like my board Smokey’s Security Forums, this blog is mainly devoted to Security and all related issues. However, other issues like e.g. major occurances on my forum and social topics will be blogged too.

My board offer free security and malware related Support, Help, Advice and Education forums, however is not limited to such issues. Smokey’s have also forums with comprehensive Microsoft Windows related issues like Microsoft and Windows OS Based Products News, MS Download Center, MSDN Developer Information, software reviews, browser and tools forums, Webware, Social Networks info, Hardware- and Gadgets forums and last but not least a dedicated Windows Drivers, Linux Drivers, Firmware and BIOS Survey & Updates section containing (recently) released Drivers, Firmware and BIOSses, Windows 7 releases included. Note: most info on Smokey’s is real-time and therefore always up-to-date.

As extra service we have a OTL (formerly OTListIt2) Log Analyzing and Malware Removal/Cleaning Help Forum, full qualified OTL Log Analysers/Malware Hunters will be pleased to help you for free to clean your malware infected PC.

Smokey’s host and maintain the Official Jetico Inc. Support Forums, including the following products:

– Jetico Personal Firewall V1
– Jetico Personal Firewall V2
– Jetico BestCrypt for Windows
– Jetico BestCrypt for Linux
– Jetico BestCrypt for Mac
– Jetico BestCrypt Volume Encryption
– Jetico BCArchive
– Jetico BCWipe for Windows
– Jetico BCWipe for UNIX

Disclaimer: information in this blog can be based on (not confirmed) statements of (anonymous) sources, Smokey’s Security Weblog don’t take any responsabilty for the credibility of these sources and their statements. Also, statements and opinions expressed in articles, reviews and other materials herein, reproduced by me, are those of the authors.

The posts/articles in this blog can be supplemented with so called “Possibly related posts” links. Because these links are automatically generated by WordPress.com, Smokey’s Security Weblog have no influence on the links itself and/or content of them. Therefore this Weblog don’t take any responsability for these links and all related issues.

About Copyright and this Blog: it is allowed to reproduce (parts of) posts in this blog if this reproduction is provided with a direct link to the original blog post. It is NOT allowed to copy, use and/or reproduce any image or blog banner.

Blog comments policy: to restrain indecent and off-topic comments and spam, comments are reviewed before publishing. Therefore, delay in comment publishing is unavoidable. Obligatory language of comments is English.
.