SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Instant Messaging/IRC/Chat)  >   Gaim Vendors:   Gaim.sourceforge.net
(Mandrake Issues Fix) Gaim Contains Multiple Overflows That Let a Remote User Execute Arbitrary Code
SecurityTracker Alert ID:  1008858
SecurityTracker URL:  http://securitytracker.com/id/1008858
CVE Reference:   CAN-2004-0006, CAN-2004-0007, CAN-2004-0008   (Links to External Site)
Date:  Jan 27 2004
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 0.75 and prior versions
Description:   Multiple vulnerabilities were reported in Gaim. A remote user can execute arbitrary code on the target user's system.

Stefan Esser of e-matters GmbH reported 12 vulnerabilities, including stack overflows, heap overflows, and an integer overflow. Some of the vulnerabilities require a man-in-the-middle attack to exploit.

Several of the vulnerabilities were due to buffer overflows in the processing of Yahoo! Messenger protocol.

An integer overflow was reported in the processing of the AIM/Oscar protocol.

A variety of other protocols and functions also contain overflows.

It is reported that two buffer overflows reside in the decoding of octal values in the yahoo_decode() function in
'gaim/src/protocols/yahoo/yahoo.c' [CVE: CAN-2004-0005]. Only version 0.75 is affected.

A remote server can send an HTTP reply header with specially crafted cookie values to trigger an overflow in 'gaim/src/protocols/yahoo/yahoo.c' in the yahoo_web_pending() function [CVE: CAN-2004-0006].

Two buffer overflows in yahoo_login_page_hash() can be triggered by specially crafted values in the Yahoo! login webpage [CVE: CAN-2004-0006].

A remote user can send a Yahoo! Messenger packet containing a specially crafted keyname value to the target server via the Yahoo! server to execute arbitrary code on the target system [CVE: CAN-2004-0006]. The flaw reportedly resides in the yahoo_packet_read() function in 'gaim/src/protocols/yahoo/yahoo.c'.

It is reported that a malicious AIM/Oscar directIM packet can trigger an overflow in the handlehdr_odc() function in 'gaim/src/protocols/oscar/ft.c' [CVE: CAN-2004-0008]. Versions 0.74 and prior are affected.

Two vulnerabilites were reported in the MIME decoding functions of quotedp_decode() in 'gaim/src/util.c' [CVE: CAN-2004-0005]. Only version 0.75 is affected.

The gaim_url_parse() function in 'gaim/src/util.c' reportedly splits URLs into fixed sized buffers [CVE: CAN-2004-0006].

The gaim_markup_extract_info_field() function in 'gaim/src/util.c' contains a stack overflow in several locations [CVE: CAN-2004-0007]. Versions 0.74 and earlier are affected.

A remote user acting as an HTTP proxy server can trigger an overflow in a connected Gaim client when the client is configured to use an HTTP proxy [CVE: CAN-2004-0006]. The flaw resides in the http_canread() function in 'gaim/src/proxy.c'.

The vendor was initially notified regarding the first of the bugs on January 4, 2004.

The original advisory is available at:

http://security.e-matters.de/advisories/012004.html
Impact:   A remote user can execute arbitrary code on the target system. In some of the vulnerabilities, the remote user must be operating as a malicious server. In some cases, the remote user must invoke a man-in-the-middle attack. In one case, a remote user can simply send a message via the Yahoo! server.
Solution:   Mandrake has released a fix.

Mandrake Linux 9.1:
0556c9ec718b1c801812d2dfa03e3c1f 9.1/RPMS/gaim-0.75-1.1.91mdk.i586.rpm
0bafaeff1aa44729acce297d983751b5 9.1/RPMS/gaim-encrypt-0.75-1.1.91mdk.i586.rpm
9230e03e6b063ea8dee4c12c7533e934 9.1/RPMS/libgaim-remote0-0.75-1.1.91mdk.i586.rpm
f8365a246c5f519e3b04acf5c356fbde 9.1/RPMS/libgaim-remote0-devel-0.75-1.1.91mdk.i586.rpm
9165b41b33f51a1132eb2437e6fbc06a 9.1/SRPMS/gaim-0.75-1.1.91mdk.src.rpm

Mandrake Linux 9.1/PPC:
f94e8bffa283f929dd24622f37785e87 ppc/9.1/RPMS/gaim-0.75-1.1.91mdk.ppc.rpm
a1e2f92c9d3e90efe682832acd2b7913 ppc/9.1/RPMS/gaim-encrypt-0.75-1.1.91mdk.ppc.rpm
bc3f3ff23f63c7886e67cafb8c5d09e8 ppc/9.1/RPMS/libgaim-remote0-0.75-1.1.91mdk.ppc.rpm
be2ef1b00eda2d96b67c4f59e8257a79 ppc/9.1/RPMS/libgaim-remote0-devel-0.75-1.1.91mdk.ppc.rpm
9165b41b33f51a1132eb2437e6fbc06a ppc/9.1/SRPMS/gaim-0.75-1.1.91mdk.src.rpm

Mandrake Linux 9.2:
0898eae6994c34bc5338befc5c3e054e 9.2/RPMS/gaim-0.75-1.1.92mdk.i586.rpm
fc6d3ffb544effe5d22c476e8a3ed6de 9.2/RPMS/gaim-encrypt-0.75-1.1.92mdk.i586.rpm
2dcf56db1cfee1408e60ae873c78231d 9.2/RPMS/gaim-festival-0.75-1.1.92mdk.i586.rpm
c9320a7b72ff220c7222185138b87aab 9.2/RPMS/gaim-perl-0.75-1.1.92mdk.i586.rpm
3e736129d087a844ce7580ae67bbca73 9.2/RPMS/libgaim-remote0-0.75-1.1.92mdk.i586.rpm
8630b36c277296aca4340cd99c158fc4 9.2/RPMS/libgaim-remote0-devel-0.75-1.1.92mdk.i586.rpm
204f4ba2d9bd6c9037377f4e8903c621 9.2/SRPMS/gaim-0.75-1.1.92mdk.src.rpm

Mandrake Linux 9.2/AMD64:
0ad839bfc084c7a8b13d1498239c81d4 amd64/9.2/RPMS/gaim-0.75-1.1.92mdk.amd64.rpm
52babbdbd27f99041cf29ef67e9eecc9 amd64/9.2/RPMS/gaim-encrypt-0.75-1.1.92mdk.amd64.rpm
e32a9b3b1c72a59a24a0cea2e4b1c05e amd64/9.2/RPMS/gaim-festival-0.75-1.1.92mdk.amd64.rpm
ed2aef050fabfb8a401be136f551b6c0 amd64/9.2/RPMS/gaim-perl-0.75-1.1.92mdk.amd64.rpm
aed398efb4623d541c90627e20c17abf amd64/9.2/RPMS/lib64gaim-remote0-0.75-1.1.92mdk.amd64.rpm
9eccc2dbba74055a9235a54c00904e88 amd64/9.2/RPMS/lib64gaim-remote0-devel-0.75-1.1.92mdk.amd64.rpm
204f4ba2d9bd6c9037377f4e8903c621 amd64/9.2/SRPMS/gaim-0.75-1.1.92mdk.src.rpm
Vendor URL:  gaim.sourceforge.net/ (Links to External Site)
Cause:   Boundary error
Underlying OS:   Linux (Mandriva/Mandrake)

Message History:   This archive entry is a follow-up to the message listed below.
Jan 26 2004 Gaim Contains Multiple Overflows That Let a Remote User Execute Arbitrary Code


 Source Message Contents
Date:  27 Jan 2004 00:51:08 -0000
Subject:  MDKSA-2004:006 - Updated gaim packages fix multiple vulnerabilities


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                Mandrake Linux Security Update Advisory
 _______________________________________________________________________

 Package name:           gaim
 Advisory ID:            MDKSA-2004:006
 Date:                   January 26th, 2004

 Affected versions:	 9.1, 9.2
 ______________________________________________________________________

 Problem Description:

 A number of vulnerabilities were discovered in the gaim instant
 messenger program by Steffan Esser, versions 0.75 and earlier.
 Thanks to Jacques A. Vidrine for providing initial patches.
 
 Multiple buffer overflows exist in gaim 0.75 and earlier:  When
 parsing cookies in a Yahoo web connection; YMSG protocol overflows
 parsing the Yahoo login webpage; a YMSG packet overflow; flaws in
 the URL parser; and flaws in the HTTP Proxy connect (CAN-2004-006).
 
 A buffer overflow in gaim 0.74 and earlier in the Extract Info Field
 Function used for MSN and YMSG protocol handlers (CAN-2004-007).
 
 An integer overflow in gaim 0.74 and earlier, when allocating memory
 for a directIM packet results in a heap overflow (CAN-2004-0008).
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0006
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0007
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0008
 ______________________________________________________________________

 Updated Packages:
  
 Mandrake Linux 9.1:
 0556c9ec718b1c801812d2dfa03e3c1f  9.1/RPMS/gaim-0.75-1.1.91mdk.i586.rpm
 0bafaeff1aa44729acce297d983751b5  9.1/RPMS/gaim-encrypt-0.75-1.1.91mdk.i586.rpm
 9230e03e6b063ea8dee4c12c7533e934  9.1/RPMS/libgaim-remote0-0.75-1.1.91mdk.i586.rpm
 f8365a246c5f519e3b04acf5c356fbde  9.1/RPMS/libgaim-remote0-devel-0.75-1.1.91mdk.i586.rpm
 9165b41b33f51a1132eb2437e6fbc06a  9.1/SRPMS/gaim-0.75-1.1.91mdk.src.rpm

 Mandrake Linux 9.1/PPC:
 f94e8bffa283f929dd24622f37785e87  ppc/9.1/RPMS/gaim-0.75-1.1.91mdk.ppc.rpm
 a1e2f92c9d3e90efe682832acd2b7913  ppc/9.1/RPMS/gaim-encrypt-0.75-1.1.91mdk.ppc.rpm
 bc3f3ff23f63c7886e67cafb8c5d09e8  ppc/9.1/RPMS/libgaim-remote0-0.75-1.1.91mdk.ppc.rpm
 be2ef1b00eda2d96b67c4f59e8257a79  ppc/9.1/RPMS/libgaim-remote0-devel-0.75-1.1.91mdk.ppc.rpm
 9165b41b33f51a1132eb2437e6fbc06a  ppc/9.1/SRPMS/gaim-0.75-1.1.91mdk.src.rpm

 Mandrake Linux 9.2:
 0898eae6994c34bc5338befc5c3e054e  9.2/RPMS/gaim-0.75-1.1.92mdk.i586.rpm
 fc6d3ffb544effe5d22c476e8a3ed6de  9.2/RPMS/gaim-encrypt-0.75-1.1.92mdk.i586.rpm
 2dcf56db1cfee1408e60ae873c78231d  9.2/RPMS/gaim-festival-0.75-1.1.92mdk.i586.rpm
 c9320a7b72ff220c7222185138b87aab  9.2/RPMS/gaim-perl-0.75-1.1.92mdk.i586.rpm
 3e736129d087a844ce7580ae67bbca73  9.2/RPMS/libgaim-remote0-0.75-1.1.92mdk.i586.rpm
 8630b36c277296aca4340cd99c158fc4  9.2/RPMS/libgaim-remote0-devel-0.75-1.1.92mdk.i586.rpm
 204f4ba2d9bd6c9037377f4e8903c621  9.2/SRPMS/gaim-0.75-1.1.92mdk.src.rpm

 Mandrake Linux 9.2/AMD64:
 0ad839bfc084c7a8b13d1498239c81d4  amd64/9.2/RPMS/gaim-0.75-1.1.92mdk.amd64.rpm
 52babbdbd27f99041cf29ef67e9eecc9  amd64/9.2/RPMS/gaim-encrypt-0.75-1.1.92mdk.amd64.rpm
 e32a9b3b1c72a59a24a0cea2e4b1c05e  amd64/9.2/RPMS/gaim-festival-0.75-1.1.92mdk.amd64.rpm
 ed2aef050fabfb8a401be136f551b6c0  amd64/9.2/RPMS/gaim-perl-0.75-1.1.92mdk.amd64.rpm
 aed398efb4623d541c90627e20c17abf  amd64/9.2/RPMS/lib64gaim-remote0-0.75-1.1.92mdk.amd64.rpm
 9eccc2dbba74055a9235a54c00904e88  amd64/9.2/RPMS/lib64gaim-remote0-devel-0.75-1.1.92mdk.amd64.rpm
 204f4ba2d9bd6c9037377f4e8903c621  amd64/9.2/SRPMS/gaim-0.75-1.1.92mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 A list of FTP mirrors can be obtained from:

  http://www.mandrakesecure.net/en/ftp.php

 All packages are signed by MandrakeSoft for security.  You can obtain
 the GPG public key of the Mandrake Linux Security Team by executing:

  gpg --recv-keys --keyserver www.mandrakesecure.net 0x22458A98

 Please be aware that sometimes it takes the mirrors a few hours to
 update.

 You can view other update advisories for Mandrake Linux at:

  http://www.mandrakesecure.net/en/advisories/

 MandrakeSoft has several security-related mailing list services that
 anyone can subscribe to.  Information on these lists can be obtained by
 visiting:

  http://www.mandrakesecure.net/en/mlist.php

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFAFbX8mqjQ0CJFipgRAlzQAKC1pem4i1b92gdoZZzjCoNAgmd9eACeKBs5
GOLeBCQEvF23gFMoElbFeA8=
=fvrJ
-----END PGP SIGNATURE-----


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2012, SecurityGlobal.net LLC