Original release date: January 24, 2002<BR>
Last revised: --<BR>
Source: CERT/CC<BR>
<P>A complete revision history can be found at the end of this file.
<A NAME="affected">
<H3>Systems Affected</H3>
<UL>
<LI>AOL Mirabilis ICQ Versions 2001A and prior</LI>
<LI>Voice Video & Games plugin installed with AOL Mirabilis ICQ
prior to version 2001B Beta v5.18 Build #3659</LI>
</UL>
<A NAME="overview">
<H2>Overview</H2>
<P> There is a remotely exploitable buffer overflow in ICQ. Attackers that
are able to exploit the vulnerability may be able to execute arbitrary
code with the privileges of the victim user. Full details are discussed in
<a href="http://www.kb.cert.org/vuls/id/570167">VU#570167</a>. An exploit
is known to exist, but we do not believe it has been distributed in the
wild. We have not seen active scanning for this vulnerability, nor have we
received any reports of this vulnerability being exploited.</P>
<A NAME="description">
<H2>I. Description</H2>
<p>ICQ is a program for communicating with other users over the Internet.
ICQ is widely used (by over 122 million people according to <A
HREF="http://www.icq.com/"><FONT COLOR="0000ff">ICQ Inc</FONT></A>, an <A
HREF="http://www.aol.com"><FONT COLOR="0000ff">AOL Time Warner</FONT></A>
owned subsidiary). A buffer overflow exists in the ICQ client for
Windows. The buffer overflow occurs during the processing of a Voice Video
& Games feature request message. This message is supposed to be a
request from another ICQ user inviting the victim to participate
interactively with a third-party application. In versions prior to 2001B,
the buffer overflow occurs in code within the ICQ client. In version 2001B
the code containing the buffer overflow was moved to an external plug-in.
<P><B>Therefore, all versions prior to the latest build of 2001B are
vulnerable. </b>Upon connection to an AOL ICQ server, vulnerable builds of
the 2001B client will be instructed by the server to disable the
vulnerable plug-in. Since versions of the ICQ client prior to 2001B do not
have an external plug-in to disable, they are vulnerable even after
connecting to the server. AOL Time Warner is recommending all users of
vulnerable versions of ICQ upgrade to <A
HREF="http://www.icq.com/download">2001B Beta v5.18 Build #3659</A>.<BR>
<BR> During normal operation, ICQ clients can exchange messages with one
another through the ICQ servers or via a direct connection. The buffer
overflow specifically occurs during the processing of the Voice Video
& Games request via a Type, Length, Value (TLV) tuple with type 0x2711
from the ICQ server, or via a crafted direct connection request.<BR>
<BR> Some versions of the ICQ client open port 4000/UDP for client-server
communication. Other versions open port 5190/TCP for this communication.
As with the previously reported <A
HREF="http://www.kb.cert.org/vuls/id/907819"><FONT COLOR="0000ff">AIM
vulnerability</FONT></A>, AOL has modified the ICQ server infrastructure
to filter malicious messages that attempt to exploit this vulnerability,
preventing it from being exploited through an AOL ICQ server. Exploiting
the vulnerability through other means (man-in-the-middle attacks,
third-party ICQ servers, DNS spoofing, network sniffing, etc.) may still
be possible. Also, since UDP packets can be broadcast on a network, a
malicious TLV packet with a spoofed source IP address may be accepted as a
legitimate server message.<BR>
<BR> The ICQ client also listens on a variably assigned TCP port for
direct connection requests. A person who wishes to establish a direct
connection can query an ICQ server for the IP address and listening port
of the victim. Versions 2000A and prior accept direct connections from
anyone by default. Later versions of ICQ can be configured to accept
direct connections from anyone. <B>Since ICQ requests can be sent directly
from one client to another, blocking requests through a central server is
not a completely effective solution.</B> The effective solution is to
apply a patch, when available, that fixes the buffer overflow, or upgrade
to 2001B Beta v5.18 Build #3659 with the Voice Video & Games feature
disabled.
<p>This vulnerability has been assigned the identifier CAN-2002-0028 by
the Common Vulnerabilities and Exposures (CVE) group:
<p><a
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0028">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0028</a>
<A NAME="impact">
<H2>II. Impact</H2>
<p>A remote attacker can execute arbitrary code with the privileges of the
victim user.</p>
<A NAME="solution">
<H2>III. Solution</H2>
<p>All users should upgrade to version <A
HREF="http://www.icq.com/download/">2001B Beta v5.18 Build #3659</A>.
There is currently no patch available for the ICQ plug-in for 2001B
or versions of the ICQ client prior to 2001B. Version <A
HREF="http://www.icq.com/download/">2001B Beta v5.18 Build
#3659's</A> installer will delete the vulnerable plug-in. In
addition, for users who log in to the server with versions of 2001B prior
to Beta v5.18 Build #3659, access to the vulnerable plug-in will be
disabled. Users with versions prior to 2001B must upgrade to mitigate this
vulnerability.
<H3>Block ICQ/SMS requests at the firewall</H3>
Blocking connections to login.icq.com and access to ports 4000/UDP,
5190/TCP and the TCP port that your client chooses to listen on may
prevent exploitation of this vulnerability. Note that the client may
establish a new listening port each time it is run. Note also that this
does not protect you from attacks within the perimeter of your
firewall.<BR> <BR>
<H3>Block untrusted messages</h3>
ICQ permits the user to deny direct connections from anyone without
authorization or accept direct connections from known peers only. We
recommend denying direct connections from anyone without authorization. By
accepting direct connections from known peers, you may still be vulnerable
to attacks that originate from known peers if the peer has been
compromised. </p>
<A NAME="vendors">
<H2>Appendix A. - Vendor Information</H2>
<P>This appendix contains information provided by vendors for this
advisory. When vendors report new information to the CERT/CC, we
update this section and note the changes in our revision history. If
a particular vendor is not listed below, we have not received their
comments.</P>
<A NAME="aol">
<H4>AOL Time Warner</H4>
See <a
href="http://web.icq.com/help/quickhelp/1,,117,00.html
">http://web.icq.com/help/quickhelp/1,,117,00.html</a>
<!-- end vendor -->
<HR NOSHADE>
<P>The CERT Coordination Center thanks Daniel Tan and AOL Time Warner for
their assistance in discovering and analyzing this vulnerability. </P>
<P></P>
<HR NOSHADE>
<P>Author: <A
HREF="mailto:cert@cert.org?subject=CA-2002-02%20Feedback%20VU%23570167">Jason
A. Rafail</A>
<hr noshade>
<p>
<A NAME="references"><H2>Appendix B. - References</H2></A>
<ol>
<li><a
href="http://www.kb.cert.org/vuls/id/570167">http://www.kb.cert.org/vuls/id/570167</a><BR>
<li><a
href="http://www.securityfocus.com/bid/3813">http://www.securityfocus.com/bid/3813</a>
<li><a
href="http://web.icq.com/help/quickhelp/1,,117,00.html">http://web.icq.com/help/quickhelp/1,,117,00.html</a>
</ol>
<!--#include virtual="/include/footer_nocopyright.html" -->
<P>Copyright 2002 Carnegie Mellon University.</P>
<P>Revision History
<PRE>
January 24, 2002: Initial release
</PRE>
|