A remote format string flaw exists in Colloquy. It fails to validate INVITE requests resulting in a format string vulnerability. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.
Classification
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
Technical
Although this flaw is exploitable, %n support is currently broken in CoreFoundation, making exploitation more difficult.
Solution
Upgrade to version 2.1 (2007-01-17) or higher, as it has been reported to fix this vulnerability. Note that this flaw was fixed in the 2007-01-17 release without a change in version number. An upgrade is required as there are no known workarounds.
info-pull.com -