Signature Detail
Short Name |
HTTP:STC:APPLE-ICHAT |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Apple iChat AIM URL Handler Remote Format String Vulnerability |
Release Date |
2007/02/06 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Apple iChat AIM URL Handler Remote Format String Vulnerability
This signature detects attempts to exploit a know vulnerability in Apple iChat. An attacker can create a malicious Web site with Web pages containing dangerous format string urls, which if accessed by a victim, allows the attacker to can gain control of the target system.
Extended Description
Apple iChat is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function. Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application and to compromise affected computers. Apple iChat version 3.1.6 (v441) is reported vulnerable; other versions may also be affected.
Affected Products
- Apple iChat 3.1.6
References