TUCoPS :: Internet :: va1995.htm

TUCoPS :: Internet :: va1995.htm
Trillian AIM Plugin Malformed XML Tag Heap Overflow Vulnerability
ZDI-08-079: Trillian AIM Plugin Malformed XML Tag Heap Overflow Vulnerability ZDI-08-079: Trillian AIM Plugin Malformed XML Tag Heap Overflow Vulnerability

WkRJLTA4LTA3OTogVHJpbGxpYW4gQUlNIFBsdWdpbiBNYWxmb3JtZWQgWE1MIFRhZyBIZWFwIE92
ZXJmbG93IA0KVnVsbmVyYWJpbGl0eQ0KaHR0cDovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5jb20v
YWR2aXNvcmllcy9aREktMDgtMDc5DQpEZWNlbWJlciA0LCAyMDA4DQoNCi0tIEFmZmVjdGVkIFZl
bmRvcnM6DQpDZXJ1bGVhbiBTdHVkaW9zDQoNCi0tIEFmZmVjdGVkIFByb2R1Y3RzOg0KQ2VydWxl
YW4gU3R1ZGlvcyBUcmlsbGlhbg0KDQotLSBWdWxuZXJhYmlsaXR5IERldGFpbHM6DQpUaGlzIHZ1
bG5lcmFiaWxpdHkgYWxsb3dzIHJlbW90ZSBhdHRhY2tlcnMgdG8gZXhlY3V0ZSBhcmJpdHJhcnkg
Y29kZSBvbg0KdnVsbmVyYWJsZSBpbnN0YWxsYXRpb25zIG9mIENlcnVsZWFuIFN0dWRpb3MgVHJp
bGxpYW4uIEF1dGhlbnRpY2F0aW9uIGlzDQpub3QgcmVxdWlyZWQgdG8gZXhwbG9pdCB0aGlzIHZ1
bG5lcmFiaWxpdHkuDQoNClRoZSBzcGVjaWZpYyBmbGF3IGV4aXN0cyB3aXRoaW4gdGhlIFhNTCBw
cm9jZXNzaW5nIGNvZGUgZm9yIFRyaWxsaWFuLg0KV2hlbiBwYXJzaW5nIGEgbWFsZm9ybWVkIFhN
TCB0YWcsIHRoZSBhcHBsaWNhdGlvbiBkb2VzIG5vdCBhbGxvY2F0ZQ0KZW5vdWdoIHNwYWNlIGZv
ciBpdCdzIGNvbnRlbnRzLiBEdXJpbmcgY29weWluZyBvZiB0aGlzIHRvIHRoZSBuZXdseQ0KYWxs
b2NhdGVkIGJ1ZmZlciwgdGhlIGFwcGxpY2F0aW9uIHdpbGwgb3ZlcndyaXRlIGhlYXAgc3RydWN0
dXJlcyB3aXRoDQphdHRhY2tlci1zdXBwbGllZCBkYXRhIHRoYXQgY2FuIHRoZW4gYmUgbGV2ZXJh
Z2VkIHRvIGFjaGlldmUgY29kZQ0KZXhlY3V0aW9uIHdpdGggdGhlIHByaXZpbGVnZXMgb2YgdGhl
IGFwcGxpY2F0aW9uLg0KDQotLSBWZW5kb3IgUmVzcG9uc2U6DQpDZXJ1bGVhbiBTdHVkaW9zIGhh
cyBpc3N1ZWQgYW4gdXBkYXRlIHRvIGNvcnJlY3QgdGhpcyB2dWxuZXJhYmlsaXR5LiBNb3JlDQpk
ZXRhaWxzIGNhbiBiZSBmb3VuZCBhdDoNCg0KaHR0cDovL2Jsb2cuY2VydWxlYW5zdHVkaW9zLmNv
bS8/cD00MDQNCg0KLS0gRGlzY2xvc3VyZSBUaW1lbGluZToNCjIwMDgtMTEtMjQgLSBWdWxuZXJh
YmlsaXR5IHJlcG9ydGVkIHRvIHZlbmRvcg0KMjAwOC0xMi0wNCAtIENvb3JkaW5hdGVkIHB1Ymxp
YyByZWxlYXNlIG9mIGFkdmlzb3J5DQoNCi0tIENyZWRpdDoNClRoaXMgdnVsbmVyYWJpbGl0eSB3
YXMgZGlzY292ZXJlZCBieToNCiAgICAqIERhbWlhbiBQdXQNCg0KLS0gQWJvdXQgdGhlIFplcm8g
RGF5IEluaXRpYXRpdmUgKFpESSk6DQpFc3RhYmxpc2hlZCBieSBUaXBwaW5nUG9pbnQsIFRoZSBa
ZXJvIERheSBJbml0aWF0aXZlIChaREkpIHJlcHJlc2VudHMgDQphIGJlc3Qtb2YtYnJlZWQgbW9k
ZWwgZm9yIHJld2FyZGluZyBzZWN1cml0eSByZXNlYXJjaGVycyBmb3IgcmVzcG9uc2libHkNCmRp
c2Nsb3NpbmcgZGlzY292ZXJlZCB2dWxuZXJhYmlsaXRpZXMuDQoNClJlc2VhcmNoZXJzIGludGVy
ZXN0ZWQgaW4gZ2V0dGluZyBwYWlkIGZvciB0aGVpciBzZWN1cml0eSByZXNlYXJjaA0KdGhyb3Vn
aCB0aGUgWkRJIGNhbiBmaW5kIG1vcmUgaW5mb3JtYXRpb24gYW5kIHNpZ24tdXAgYXQ6DQoNCiAg
ICBodHRwOi8vd3d3Lnplcm9kYXlpbml0aWF0aXZlLmNvbQ0KDQpUaGUgWkRJIGlzIHVuaXF1ZSBp
biBob3cgdGhlIGFjcXVpcmVkIHZ1bG5lcmFiaWxpdHkgaW5mb3JtYXRpb24gaXMNCnVzZWQuIFRp
cHBpbmdQb2ludCBkb2VzIG5vdCByZS1zZWxsIHRoZSB2dWxuZXJhYmlsaXR5IGRldGFpbHMgb3Ig
YW55DQpleHBsb2l0IGNvZGUuIEluc3RlYWQsIHVwb24gbm90aWZ5aW5nIHRoZSBhZmZlY3RlZCBw
cm9kdWN0IHZlbmRvciwNClRpcHBpbmdQb2ludCBwcm92aWRlcyBpdHMgY3VzdG9tZXJzIHdpdGgg
emVybyBkYXkgcHJvdGVjdGlvbiB0aHJvdWdoDQppdHMgaW50cnVzaW9uIHByZXZlbnRpb24gdGVj
aG5vbG9neS4gRXhwbGljaXQgZGV0YWlscyByZWdhcmRpbmcgdGhlDQpzcGVjaWZpY3Mgb2YgdGhl
IHZ1bG5lcmFiaWxpdHkgYXJlIG5vdCBleHBvc2VkIHRvIGFueSBwYXJ0aWVzIHVudGlsDQphbiBv
ZmZpY2lhbCB2ZW5kb3IgcGF0Y2ggaXMgcHVibGljbHkgYXZhaWxhYmxlLiBGdXJ0aGVybW9yZSwg
d2l0aCB0aGUNCmFsdHJ1aXN0aWMgYWltIG9mIGhlbHBpbmcgdG8gc2VjdXJlIGEgYnJvYWRlciB1
c2VyIGJhc2UsIFRpcHBpbmdQb2ludA0KcHJvdmlkZXMgdGhpcyB2dWxuZXJhYmlsaXR5IGluZm9y
bWF0aW9uIGNvbmZpZGVudGlhbGx5IHRvIHNlY3VyaXR5DQp2ZW5kb3JzIChpbmNsdWRpbmcgY29t
cGV0aXRvcnMpIHdobyBoYXZlIGEgdnVsbmVyYWJpbGl0eSBwcm90ZWN0aW9uIG9yDQptaXRpZ2F0
aW9uIHByb2R1Y3QuDQoNCk91ciB2dWxuZXJhYmlsaXR5IGRpc2Nsb3N1cmUgcG9saWN5IGlzIGF2
YWlsYWJsZSBvbmxpbmUgYXQ6DQoNCiAgICBodHRwOi8vd3d3Lnplcm9kYXlpbml0aWF0aXZlLmNv
bS9hZHZpc29yaWVzL2Rpc2Nsb3N1cmVfcG9saWN5Lw0KDQpDT05GSURFTlRJQUxJVFkgTk9USUNF
OiBUaGlzIGUtbWFpbCBtZXNzYWdlLCBpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzLA0KaXMgYmVp
bmcgc2VudCBieSAzQ29tIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIGludGVuZGVkIHJlY2lwaWVu
dChzKSBhbmQNCm1heSBjb250YWluIGNvbmZpZGVudGlhbCwgcHJvcHJpZXRhcnkgYW5kL29yIHBy
aXZpbGVnZWQgaW5mb3JtYXRpb24uDQpBbnkgdW5hdXRob3JpemVkIHJldmlldywgdXNlLCBkaXNj
bG9zdXJlIGFuZC9vciBkaXN0cmlidXRpb24gYnkgYW55IA0KcmVjaXBpZW50IGlzIHByb2hpYml0
ZWQuICBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2UNCmRlbGV0
ZSBhbmQvb3IgZGVzdHJveSBhbGwgY29waWVzIG9mIHRoaXMgbWVzc2FnZSByZWdhcmRsZXNzIG9m
IGZvcm0gYW5kDQphbnkgaW5jbHVkZWQgYXR0YWNobWVudHMgYW5kIG5vdGlmeSAzQ29tIGltbWVk
aWF0ZWx5IGJ5IGNvbnRhY3RpbmcgdGhlDQpzZW5kZXIgdmlhIHJlcGx5IGUtbWFpbCBvciBmb3J3
YXJkaW5nIHRvIDNDb20gYXQgcG9zdG1hc3RlckAzY29tLmNvbS4gDQo