|
Gaim Multiple Buffer Overflow Vulnerabilities
|
|
Secunia Advisory:
|
SA10705
|
|
|
Release Date:
|
2004-01-27
|
|
Last Update:
|
2004-05-11
|
|
Popularity:
|
10,251 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Gaim 0.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2004-0005
CVE-2004-0006
CVE-2004-0007
CVE-2004-0008
|
|
Description:
Stefan Esser has identified multiple vulnerabilities in Gaim, which can be exploited by malicious people to compromise a user's system.
The vulnerabilities are all caused due to boundary errors in the YMSG protocol handler, the oscar protocol handler, various utility functions, and the HTTP proxy connection handling. These can be exploited to cause buffer overflows, where some may allow execution of arbitrary code on a user's system.
Version 0.75 and prior have been reported vulnerable.
Solution:
Update to version 0.76.
http://sourceforge.net/project/showfiles.php?group_id=235
Provided and/or discovered by:
Stefan Esser
Changelog:
2004-04-02: Updated "Solution" section.
2004-05-03: Added links to US-CERT vulnerability notes.
2004-05-07: Added links to US-CERT vulnerability notes.
2004-05-11: Added links to US-CERT vulnerability notes.
Original Advisory:
http://security.e-matters.de/advisories/012004.html
Other References:
US-CERT VU#190366:
http://www.kb.cert.org/vuls/id/190366
US-CERT VU#197142:
http://www.kb.cert.org/vuls/id/197142
US-CERT VU#226974:
http://www.kb.cert.org/vuls/id/226974
US-CERT VU#297198:
http://www.kb.cert.org/vuls/id/297198
US-CERT VU#371382:
http://www.kb.cert.org/vuls/id/371382
US-CERT VU#404470:
http://www.kb.cert.org/vuls/id/404470
US-CERT VU#444158:
http://www.kb.cert.org/vuls/id/444158
US-CERT VU#503030:
http://www.kb.cert.org/vuls/id/503030
US-CERT VU#527142:
http://www.kb.cert.org/vuls/id/527142
US-CERT VU#655974:
http://www.kb.cert.org/vuls/id/655974
US-CERT VU#779614:
http://www.kb.cert.org/vuls/id/779614
US-CERT VU#871838:
http://www.kb.cert.org/vuls/id/871838
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
