Software Engineering Institute

ICQ is a instant messaging application that is maintained by AOL.

A buffer overflow vulnerability in ICQ Pro 2003b may allow a remote, unauthenticated attacker to execute arbitrary code or create a denial-of-service condition. By sending a specially crafted message to a vulnerable ICQ client, an attacker can trigger the overflow.

This vulnerability may also be exploited by convincing a user to connect to a malicious server.

A remote, unauthenticated attacker can execute arbitrary code with the privileges of the user who is running ICQ or create a denial-of-service condition.

Upgrade
AOL has addressed this issue in version 5.1 of the ICQ client.

Limit privileges

Running the ICQ client with reduced privileges may help mitigate the effects of this vulnerability. Users with administrator access can run ICQ with reduced privileges by following the instructions in Microsoft knowledgebase article 294676.