Re: [Full-disclosure] ICQ 6 protocol bug?

[Darren Reed <darrenr@xxxxxxxxxxxx>]

Valdis.Kletnieks@xxxxxx wrote:
> On Sat, 14 Feb 2009 23:26:48 +0200, James Matthews said:
>
>   
>> ICQ is known to have a few remote bugs. I use meebo.com instead of a client
>> due to these issues.
>>     
>
> At which point you're probably trading known bugs for unknown bugs. ;)
>
> Of course, this is a battle the user can't win. The other option is to
> toss the proprietary ICQ client and use some other open-source client like
> Pidgin - at which point you're trading known ICQ bugs for unknown Pidgin bugs.
> At that point, your best bet is to consider 2 things:
>
> 1) What client am I most likely to see actual attacks against?
> 2) What client am I the most worried about attacks?
>
> (Note the two don't have to be the same - widespread ICQ attacks may be more
> common, but maybe you worry more about getting hit with a Pidgin attack 
> because
> it possibly means you're being targeted....)
>   

Pidgin seems to spontaneously self combust without it being attacked.
Which is just a little bit more disruptive.

So there's the trade off: do i worry about attacks or worry about my
conversation being randomly disrupted?

But in summary, nobody seems to know of anything new, so I need
to watch the icq traffic with wireshark to see what's what.

At the very least, messages from unknown parties can be ignored
and it seems to be the rendering(again!) that has caused problems.

Darren

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/