GoKawiilICQ Server Flaw Lets Attackers Log In to Any Account Without Password
A bug reported to Rootshell revealed that ICQ's authentication servers could be accessed using any account's UIN paired with a 9-character password, bypassing the real password entirely. The developer of a Linux ICQ client discovered the flaw after a user mistyped a password but was still logged in, tracing it to a buffer overflow in Mirabilis's server-side password check. Rootshell confirmed the bug and published exploit details, including sample code and a 'password' like '123456789' that overruns the 8-character buffer.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw meant any ICQ account could potentially be hijacked without guessing or stealing a real password, since the server-side check—not the client—was responsible for enforcing password length. Publication of working exploit details on a security bulletin board likely accelerated real-world exploitation before Mirabilis could patch the issue, a common risk in late-1990s vulnerability disclosure practices.
- A buffer overflow in ICQ's server-side authentication allowed login to any account using an oversized password string.
- The bug was found by a third-party Linux ICQ client developer, not by ICQ's maker Mirabilis.
- Rootshell confirmed and publicly published the exploit method, exposing the flaw before any official fix was noted.
Source: opennet.ru, 2026-10-13
Published there as: “Major ICQ security hole (1998)”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.