CVE-2005-3889

Vulnerability

Gadu-Gadu instant messenger version 7.20 (and possibly earlier versions) is vulnerable to a denial-of-service condition when a remote attacker sends multiple DCC (Direct Client Connection) packets with a code value of 6 or 7 [1]. This causes the application to generate a large number of popup windows and spawn an excessive number of threads, overwhelming system resources.

Exploitation

An attacker can exploit this vulnerability by sending a series of crafted DCC packets with code 6 or 7 to a target user running Gadu-Gadu 7.20. No authentication or user interaction beyond receiving the packets is required; the attack can be launched remotely over the network.

Impact

Successful exploitation results in a denial of service. The target's Gadu-Gadu client becomes unresponsive or crashes due to resource exhaustion from the flood of popup windows and threads. The attacker does not gain code execution or data access.

Mitigation

No official patch or workaround is mentioned in the available references [1]. Users should consider upgrading to a later version of Gadu-Gadu if available, as the vulnerability was reported in 2005 and likely addressed in subsequent releases.