ICQ's 1998 Password Bug Let Anyone Log In as Anyone
Major ICQ security hole (1998)
A 1998 Rootsell security bulletin revealed a critical flaw in ICQ: sending a password of 9 or more characters overflowed the server's buffer, allowing login as any UIN without knowing the password. Discovered by a Linux ICQ clone developer after a user mistyped their password and still got in, the exploit let attackers read offline messages and send/receive as the victim. Mirabilis/AOL needed to fix it.
It is possible to log in to the ICQ servers as ANYONE without having to know their password.
- compass_copium
>When a password of 9 or more characters is sent, their buffer is over-run, and it allows you to log in.
Man, computers used to be fun
- SillyUsername
So this is how my low numbered account was stolen back in the day - thanks for sharing.
- taspeotis
Rewrite it in Rust