[ http://www.rootshell.com/ ] From zallison@rice.edu Thu Aug 13 22:34:42 1998 Date: Thu, 13 Aug 1998 23:25:49 -0300 From: zack To: kit@rootshell.com Subject: Major ICQ security hole. Greetings... I code a linux ICQ clone, and after one of my users mistyped his password, and was allowed into his account anyway. After further investivating, this is what I found. * It is possible to log in to the ICQ servers as ANYONE without having to know their password. This leads to all sorts of comprimises. This is *not* simply spoofing How it works: The mirabilis server uses a password of 8 chars. Their clients do the range checking and only send in passwords of 8 or less chars. The Linux clones, mine in particular, don't do this. * When a password of 9 or more characters is sent, their buffer is over-run, and it allows you to log in. The exploit: Download any ICQ clone (example: http://hookah.ml.org/zicq) Set the UIN to be the targets UIN Set the password to "123456789" <-- Just large enough to overflow Start the ICQ program. If all goes well, it will log in and connect, as that user. Any waiting (offline) messages will be delivered to you. You can now send _and_ recieve messages and URLS as the client allows. Notes: This is NOT spoofing, you are actually logged in as the selected UIN. Unlike spoofing you can recieve messages as well. All UINS will work, as long as someone is not already logged in with that UIN. Mirabilis / AOL really needs to fix this problem. Zack