[NT] Cerulean Studios Trillian UTF-8 Word Wrap Heap Overflow Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Cerulean Studios Trillian UTF-8 Word Wrap Heap Overflow Vulnerability
------------------------------------------------------------------------

SUMMARY

<http://www.ceruleanstudios.com/learn> Trillian is "a multi-protocol chat
application that supports IRC, ICQ, AIM and MSN protocols". Remote
exploitation of a heap overflow vulnerability in Cerulean Studios Trillian
Instant Messenger could allow attackers to execute arbitrary code as the
currently logged on user.

DETAILS

Vulnerable Systems:
* Cerulean Studios Trillian version 3.1.5.1

Immune Systems:
* Cerulean Studios Trillian version 3.1.6.0

The vulnerability specifically exists due to improper handling of UTF-8
sequences. When word-wrapping UTF-8 text, the window width is improperly
used as a buffer size value. As such, heap corruption can occur leading to
a potentially exploitable condition.

Analysis:
Exploitation of this vulnerability could allow remote attackers to execute
arbitrary code with the credentials of the currently logged on user.

Exploitation occurs simply by viewing a malicious message that contains a
specially constructed UTF-8 string.

The MSN protocol is a known attack vector for this vulnerability. However,
exploitation could potentially occur using any supported
protocol.

Vendor response:
The Cerulean Studios team has addressed this vulnerability by releasing
version 3.1.6.0 of Trillian. More information is available at the Cerulean
Studios Blog via the following URL:
<http://blog.ceruleanstudios.com/?p=150>

http://blog.ceruleanstudios.com/?p=150

Disclosure timeline:
05/04/2007 - Initial vendor notification
05/04/2007 - Initial vendor response
06/18/2007 - Coordinated public disclosure

ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=545>

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=545

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.