Description
ICQ 7 does not verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a crafted file that is fetched through an automatic-update mechanism.
References
- VU#680540 third-party-advisory
- 20110114 Remote Code Execution in ICQ 7 mailing-list
- 45805 vdb-entry
- icq-updates-code-execution(64711) vdb-entry
- 70486 vdb-entry