QIP 2005 Denial of Service Vulnerability
ShineShadow Security Report 04012009-07
TITLE
QIP 2005 Denial of Service Vulnerability
BACKGROUND
QIP 2005 is a freeware program with closed source, alternative instant
messaging client based on the OSCAR protocol. It has full support of ICQ and
experimental support of AIM.
Product website: www.qip.ru
VULNERABLE PRODUCTS
QIP 2005 build 8082 (latest build)
Previous versions may also be affected
DETAILS
Denial-of-service (DoS) vulnerability exists in QIP 2005 instant messenger
software. An attacker could try to exploit the vulnerability by sending
specially crafted message in RTF format to remote QIP client. The message could
cause "freezing" the vulnerable application and using 100% CPU.
Exploit message example:
{\rtf\pict\&&}
Its remote exploitation vulnerability, no authentication or social engineering
is required.
Probably vulnerable code exists in third party TRichView component that using
QIP, but its not confirmed.
EXPLOITATION
Remote attacker can exploit this vulnerability using any instant messenger
software with OSCAR (ICQ) protocol support by sending specialy crafted message
in RTF format.
WORKAROUND
No workarounds
DISCLOSURE TIMELINE
29/01/2009 Initial vendor notification
30/01/2009 Vendor response
03/01/2009 New build has been released with same vulnerability
04/01/2009 Advisory released
CREDITS
Maxim Kulakov (aka ShineShadow)
ss_contacts@xxxxxxxxxxx