PSI remote integer overflow DoS
Remote denial of service due to integer overflow in PSI, Jabber client.
Antecedentes
PSI is a widely used Jabber client, based on Qt4 and available for Windows, Mac, Linux, and other operating systems.
Description
File transfers require an open port (default 8010/tcp). If the first byte of the data stream is 0x05 (SOCKS5 option), the vulnerable section of the code is entered, where the second byte indicates the number of bytes to copy with memcpy. The size check uses a signed comparison, so negative values (0x80–0xff) are accepted, which bypass it through integer overflow; it should be compared unsigned.
Business impact
Remote or local denial of communication services.
Affected systems
PSI 0.11, 0.12, and 0.13 (the latter). PSI 0.10 is unaffected, and 0.12.1 fixes the issue. Tested on Linux and Windows, although it may block other heap implementations.
Solución
PSI 0.12.1 resolves the issue; however, it is recommended to filter this port whenever possible.
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-independent provider with in-depth experience since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)