[security-alerts] FW: [SA20010] ICQ Advertisement Banners "My Computer" Zone Script Execution

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> 
> TITLE:
> ICQ Advertisement Banners "My Computer" Zone Script Execution
> 
> SECUNIA ADVISORY ID:
> SA20010
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/20010/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> Security Bypass
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> ICQ 5.x
> http://secunia.com/product/9856/
> 
> DESCRIPTION:
> QQlan has reported a vulnerability in ICQ, which can be exploited by
> malicious people to bypass certain security restrictions.
> 
> The vulnerability is caused due to advertisement banners being
> displayed insecurely inside the application. This can be exploited to
> execute arbitrary HTML and script code in the "My Computer" zone.
> 
> Successful exploitation requires that the attacker is able to
> intercept and manipulate traffic.
> 
> The vulnerability has been reported in version 5.04 (build 2321).
> Other versions may also be affected.
> 
> SOLUTION:
> Use another product.
> 
> PROVIDED AND/OR DISCOVERED BY:
> QQlan
> 
> ORIGINAL ADVISORY:
> http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/04
> 5916.html
>