製品・ソフトウェアに関する情報

JVN脆弱性詳細

AOL ICQ Pro の MCRegEx__Search 関数におけるヒープベースのバッファオーバーフローの脆弱性

Title	AOL ICQ Pro の MCRegEx__Search 関数におけるヒープベースのバッファオーバーフローの脆弱性
Summary	AOL ICQ Pro の MCRegEx__Search 関数には、ヒープベースのバッファオーバーフローの脆弱性が存在します。
Possible impacts	第三者により、Type-Length-Value (TLV) タイプ 0x2711 内のメッセージの一致しない length フィールドを介して、任意のコードを実行される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 8, 2006, midnight
Registration Date	Sept. 25, 2012, 3:35 p.m.
Last Update	Sept. 25, 2012, 3:35 p.m.

Affected System

mirabilis

icq Pro 2003b Build 3916 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2006-4662	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4662
National Vulnerability Database (NVD)
2	CVE-2006-4662	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-4662

ベンダー情報

No	Name	URL
mirabilis
1	Top Page	http://www.icq.com/en

その他

No	Name	URL
US-CERT Vulnerability Note
1	VU#400780	http://www.kb.cert.org/vuls/id/400780

Change Log

No	Changed Details	Date of change
0	[2012年09月25日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2006-4662

Summary	Heap-based buffer overflow in the MCRegEx__Search function in AOL ICQ Pro 2003b Build 3916 and earlier allows remote attackers to execute arbitrary code via an inconsistent length field of a Message in a 0x2711 Type-Length-Value (TLV) type.
Publication Date	Sept. 9, 2006, 9:04 a.m.
Registration Date	Jan. 29, 2021, 3:45 p.m.
Last Update	Oct. 18, 2018, 6:38 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:mirabilis:icq:0.99b_1.1.1.1:::::::*
cpe:2.3:a:mirabilis:icq:0.99b_v.3.19:::::::*
cpe:2.3:a:mirabilis:icq:98.0a:::::::*
cpe:2.3:a:mirabilis:icq:99a_2.15build1701:::::::*
cpe:2.3:a:mirabilis:icq:99a_2.21build1800:::::::*
cpe:2.3:a:mirabilis:icq:2000.0a:::::::*
cpe:2.3:a:mirabilis:icq:2000.0b_build3278:::::::*
cpe:2.3:a:mirabilis:icq:2001a:::::::*
cpe:2.3:a:mirabilis:icq:2001b_build3636:::::::*
cpe:2.3:a:mirabilis:icq:2001b_build3638:::::::*
cpe:2.3:a:mirabilis:icq:2001b_build3659:::::::*
cpe:2.3:a:mirabilis:icq:2002a_build3722:::::::*
cpe:2.3:a:mirabilis:icq:2002a_build3727:::::::*
cpe:2.3:a:mirabilis:icq:2003a:::::::*
cpe:2.3:a:mirabilis:icq:2003a_build3777:::::::*
cpe:2.3:a:mirabilis:icq:2003a_build3799:::::::*
cpe:2.3:a:mirabilis:icq:2003a_build3800:::::::*
cpe:2.3:a:mirabilis:icq:2003b:::::::*
cpe:2.3:a:mirabilis:icq:2003b_build3096::pro:::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://secunia.com/advisories/21834	SECUNIA
2	http://securityreason.com/securityalert/1530	SREASON
3	http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1509	MISC	Patch Vendor Advisory
4	http://www.kb.cert.org/vuls/id/400780	CERT-VN	US Government Resource
5	http://www.securityfocus.com/archive/1/445513/100/0/threaded	BUGTRAQ
6	http://www.securityfocus.com/bid/19897	BID	Patch
7	http://www.vupen.com/english/advisories/2006/3527	VUPEN
8	https://exchange.xforce.ibmcloud.com/vulnerabilities/28835	XF

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:mirabilis:icq:0.99b_1.1.1.1:::::::*
cpe:2.3:a:mirabilis:icq:0.99b_v.3.19:::::::*
cpe:2.3:a:mirabilis:icq:98.0a:::::::*
cpe:2.3:a:mirabilis:icq:99a_2.15build1701:::::::*
cpe:2.3:a:mirabilis:icq:99a_2.21build1800:::::::*
cpe:2.3:a:mirabilis:icq:2000.0a:::::::*
cpe:2.3:a:mirabilis:icq:2000.0b_build3278:::::::*
cpe:2.3:a:mirabilis:icq:2001a:::::::*
cpe:2.3:a:mirabilis:icq:2001b_build3636:::::::*
cpe:2.3:a:mirabilis:icq:2001b_build3638:::::::*
cpe:2.3:a:mirabilis:icq:2001b_build3659:::::::*
cpe:2.3:a:mirabilis:icq:2002a_build3722:::::::*
cpe:2.3:a:mirabilis:icq:2002a_build3727:::::::*
cpe:2.3:a:mirabilis:icq:2003a:::::::*
cpe:2.3:a:mirabilis:icq:2003a_build3777:::::::*
cpe:2.3:a:mirabilis:icq:2003a_build3799:::::::*
cpe:2.3:a:mirabilis:icq:2003a_build3800:::::::*
cpe:2.3:a:mirabilis:icq:2003b:::::::*
cpe:2.3:a:mirabilis:icq:2003b_build3096::pro:::::