QIP 2005 is "a freeware program with closed source, alternative instant messaging client based on the OSCAR protocol. It has full support of ICQ and experimental support of AIM". A vulnerability in the QIP client allows remote attackers to cause it to freeze by sending it a malformed RTF header.
Denial-of-service (DoS) vulnerability exists in QIP 2005 instant messenger software. An attacker could exploit the vulnerability by sending specially crafted message in RTF format to remote QIP client. The message causes "freezing" the vulnerable application.
Exploit:
{\rtf\pict\&&}
It is a remote exploitation vulnerability, no authentication or social engineering is required. Probably vulnerable code exists in third party TRichView component that QIP is using, but its not confirmed.
