Text bug blights Trillian
Rather Dented
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Users of the popular Trillian instant messaging client need to update their software following the discovery of a serious security bug.
The multi-protocol chat application from Cerulean Studios is subject to a heap overflow vulnerability because of programming errors involving the word-wrapping of UTF-8 text.
As a result, hackers might be able to crash versions of the application, thereby loading exploit code onto vulnerable systems. Viewing a malicious message containing a specially malformed UTF-8 string would be enough to trigger the attack.
"The MSN protocol is a known attack vector for this vulnerability. However, exploitation could potentially occur using any supported protocol," an advisory by iDefense warns.
Users are advised to update to a patched version of Trillian - version 3.1.6.0 - in order to guard against attack, as explained in an posting on Cerulean Studios' Trillian blog here. ®
COMMENTS
Don't Panic!
There's a well-mixed Pan-Galactic Gargle Blaster (plus free rehabilitation) for whoever came up with the sub-heading for this article...
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
