Secunia

LogicLibrary has reported some vulnerabilities in Trillian, allowing malicious people to compromise a users system.

The vulnerabilities are caused due to boundary errors in the handling of HTTP/1.1 response headers. This can be exploited to cause a heap-based buffer overflow and execute arbitrary code by sending a maliciously crafted HTTP/1.1 response.

Successful exploitation requires that the attacker controls a server, which Trillian connects to, or is able to conduct a Man-in-the-Middle attack.

The vulnerabilities have been reported in the AIM, Yahoo, MSN, RSS and possibly other plug-ins in Trillian 2.0. It has also been reported in the Yahoo IM and possibly other plug-ins in Trillian version 3.0 and 3.1.

Solution
Use another product.

Provided and/or discovered by
LogicLibrary

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area