Description
Multiple buffer overflows in the IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service and possibly execute arbitrary code via (1) a large response from the server, (2) a JOIN with a long channel name, (3) a long "raw 221" message, (4) a PRIVMSG with a long nickname, or (5) a long response from an IDENT server.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 5
- Trillian 0.74 - IRC Oversized Data Block Buffer Overflow EDB-21823 · dos · Sep 22, 2002 · verified
- Trillian 0.725/0.73/0.74 - IRC User Mode Numeric Remote Buffer Overflow EDB-21816 · dos · Sep 21, 2002 · verified
- Trillian 0.73/0.74 - IRC JOIN Buffer Overflow EDB-21813 · dos · Sep 20, 2002 · verified
- Trillian 0.73/0.74 - IRC PRIVMSG Buffer Overflow EDB-21810 · remote · Sep 19, 2002 · verified
- Trillian 0.6351/0.7x - Identd Buffer Overflow EDB-21804 · remote · Sep 18, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 5777 vdb-entry
- 5769 vdb-entry
- 5765 vdb-entry
- trillian-raw221-bo(10151) vdb-entry
- 20020922 *sigh* Trillian multiple DoS mailing-list
- 20020921 And Again. Trillian 'raw 221' Overflow. mailing-list
- trillian-irc-server-bo(10163) vdb-entry
- 20020920 Yet Another. Trillian 'JOIN' Overflow. mailing-list
- 20020914 Trillian .74 and below, ident flaw. mailing-list
- 20020919 Trillian .73 & .74 "PRIVMSG" Overflow. mailing-list
- trillian-irc-join-bo(10150) vdb-entry