Major ICQ security hole (1998)

A serious authentication vulnerability in ICQ from 1998 is described: a Linux client implementation that failed to enforce the server's eight-character password limit allowed attackers to bypass login credentials and access any account. The flaw was discovered by a developer of a Linux ICQ clone who observed a mistyped password nonetheless granting access. Rootshell confirmed the finding and emphasized this is not mere identity spoofing but a direct authentication bypass that enables complete account compromise.

Technically, the Mirabilis server expects passwords no longer than eight characters and relies on client-side length checking. When a client sends a password of nine or more characters, the server’s password buffer is overrun and authentication is erroneously granted. The exploit is straightforward: use an ICQ clone that does not restrict password length, set the target UIN, and submit a nine-character password (demonstrated with a simple sequence of nine digits) to gain entry. The bulletin warns of widespread implications because many third-party clients lacked the proper range checking, making them vectors for easy unauthorized access.