Critical Update for Trillian Chat Client

Cerulean Studios has issued an update to its Trillian ICQ, IRC, IM multi-protocol chat client that fixes a critical security hole in the popular software.

Security researcher iDefense originally found the trouble and alerted Cerulean last week which hurried out the patched version. The iDefense alert points out that this is a "heap overflow" condition problem, which is similar to a buffer overflow, which I've talked about before.

The trick to this kind of exploit is to . . . well, trick the IM client software by sending it more information than it was designed to handle. This confuses the heap, which is a lot like a buffer, causing an overflow condition. In the real world, it might be a little like taking a wrong turn in a bad section of town and getting completely lost and thus becoming confused and, therefore, vulnerable. Once the heap overflow condition has been achieved, a clever cracker's attack program would be able to take over your PC while it's distracted.

So while no active exploits have been reported, many of the worst attacks do occur to people who haven't patched an older hole that a nefarious individual has taken advantage of. The operative language to look out for is just what iDefense researchers said: "[successful exploitation] could allow attackers to execute arbitrary code as the currently logged on user." That's a recipe for a drive-by download or something equally as onerous.

If you use Trillian, the patched version is numbered 3.1.6.0. You can check out Cerulean's discussion for slightly more info and get the update at the same URL. Existing customers should get an auto update notice the next time they start their Trillian client.

Comments

Post a comment Post a comment

0 / 1000 max characters