| VID |
23118 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
P2P |
| Detailed Description |
The relevant version of the Trillian program has multiple remote HTTP response buffer overflow vulnerabilities. Trillian is a peer-to-peer (P2P) file sharing program for Microsoft Windows operating system used to share audio, video, and other media files. AIM, Yahoo, MSN, RSS feeds and possibly other plug-ins for Trillian Pro version 2.0 and Yahoo IM and possibly other plug-ins for Trillian Basic versions 3.0 and 3.1 are vulnerable to several heap-based buffer overflows, caused by boundary errors in the handling of HTTP/1.1 response headers. An attacker could exploit these flaws to execute arbitrary code by sending a maliciously crafted HTTP/1.1 response. Successful exploitation requires that the attacker controls a server, which Trillian connects to, or is able to conduct a Man-in-the-Middle attack.
* Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of these condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
http://secunia.com/advisories/14689/
* Platforms Affected:
Cerulean Studios, Trillian Basic 3.0
Cerulean Studios, Trillian Basic 3.1
Cerulean Studios, Trillian Pro 1.0
Cerulean Studios, Trillian Pro 2.0
Microsoft Windows Any version |
| Recommendation |
If P2P file sharing is not allowed at your organization, uninstall the Trillian program.
-- OR --
No upgrade or patch available as of March 2005.
Upgrade to the new version of Trillian (3.1.0.121 later), when new version fixed this problem becomes available from the Trillian Web page at http://www.trillian.cc |
| Related URL |
CVE-2005-0737 (CVE) |
| Related URL |
12890 (SecurityFocus) |
| Related URL |
19822 (ISS) |
|
