: Vendor provides an official statement.Ī vulnerability in AOL's ICQ Pro 2003b instant messenger client could lead to denial of service attacks and remote compromise of systems running vulnerable versions of the client. Baring a precise schedule that demonstrates an imminent release of fixes the publication date is final. 6th in order to receive offical statement from vendor. : Core response to vendor, publication of advisories will be delayed until Sept. No tentative fix schedule made available, earliest date for an official vendor statement about fixes is Sept.

: Vendor response received stating that 30 days is insufficient to fix bugs and reiterating the previously noted coordination and communications problems with engineering team at remote facilities. : Updated advisory sent to vendor requesting comments and fix availability information. : In liue of proof-of-concept, Core provides succinct technical explanation of the problem in the ICQ 2003b client. : Vendor email describing coordination issues with ICQ development team. : Core response vendor: proof-of-concept can not be made available as standalone program without incurring in a substantial development effort. : Core response vendor: proof-of-concept for the ICQ client bug can not be made available as standalone program without incurring in a substantial development effort. : Vendor email received requesting further technical details or proof-of-concept code. A new update from the vendor forthcoming before Aug. Still determining when a fix will be available. : Request for an update sent to vendor asking for an estimated date for fix availability, advisory release date now set for Aug. : Request for an update sent to vendor asking for an estimated date for fix availability. : Vendor response acknowledging notification. : Initial notification sent to vendor, advisory release date set for Aug. Title: AOL ICQ Pro 2003b heap overflow vulnerability

Download icq 2003b