GoKawiilICQ Server Flaw Lets Attackers Log In to Any Account Without Password
A bug reported to Rootshell revealed that ICQ's authentication servers could be accessed using any account's UIN paired with a 9-character password, bypassing the real password entirely. The developer of a Linux ICQ client discovered the flaw after a user mistyped a password but was still logged in, tracing it to a buffer overflow in Mirabilis's server-side password check. Rootshell confirmed the bug and published exploit details, including sample code and a 'password' like '123456789' that overruns the 8-character buffer.