(Conectiva Issues Fix) Gaim Buffer Overflows in Groupware Messages, URLs, Hostname Lookups, and RTF Messages May Permit Remote Code Execution
|
|
SecurityTracker Alert ID: 1012091 |
|
SecurityTracker URL: http://securitytracker.com/id/1012091
|
|
CVE Reference:
CAN-2004-0785, CAN-2004-0754
(Links to External Site)
|
Date: Nov 5 2004
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 0.82
|
Description:
Several overflow vulnerabilities were reported in Gaim. A remote user may be able to execute arbitrary code on the target system. A remote server can also cause the Gaim client to crash.
The vendor reported that a remote groupware server can send specially crafted messages to a target client to trigger a memory allocation integer overflow [CVE: CAN-2004-0754]. The resulting heap overflow may allow arbitrary code to be executed.
It is also reported that a remote user can send a specially crafted URL that, when received by the target user, will overflow a static buffer of 2048 bytes [CVE: CAN-2004-0785].
It is also reported that a hostname lookup overflow can be triggered [CVE: CAN-2004-0785]. If the DNS server returns a hostname that is greater than MAXHOSTNAMELEN bytes, a buffer overflow will occur.
It is also reported that a remote user can create an invalid rich text format (RTF) message to trigger one of several buffer overflows [CVE: CAN-2004-0785].
It is also reported that a remote web server can return a large HTTP Content-Length header value to cause the target user's Gaim to crash. This can be triggered if the supplied length value is large enough to cause Gaim to consume all available memory. This can occur when Gaim reads profile information on some protocols and when smiley themes are installed via drag and drop.
The original advisories are available at:
http://gaim.sourceforge.net/security/index.php?id=2
http://gaim.sourceforge.net/security/index.php?id=3
http://gaim.sourceforge.net/security/index.php?id=4
http://gaim.sourceforge.net/security/index.php?id=5
http://gaim.sourceforge.net/security/index.php?id=6
|
Impact:
A remote user can cause arbitrary code to be executed on the target application or cause the application to crash.
|
Solution:
Conectiva has released a fix.
ftp://atualizacoes.conectiva.com.br/10/SRPMS/gaim-1.0.2-69982U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-am-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-bg-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ca-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-cs-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-da-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-de-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-en_AU-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-en_CA-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-en_GB-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-es-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-fi-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-fr-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-he-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-hi-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-hu-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-it-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ja-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ko-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-lt-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-mk-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-nl-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-no-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-pl-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-pt-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-pt_BR-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ro-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ru-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-sk-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-sl-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-sr-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-sv-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-vi-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-zh_CN-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-zh_TW-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libgaim-remote-devel-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libgaim-remote0-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/gaim-1.0.2-27683U90_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/gaim-1.0.2-27683U90_2cl.i386.rpm
|
Vendor URL: gaim.sourceforge.net/security/ (Links to External Site)
|
Cause:
Boundary error, Input validation error
|
Underlying OS:
Linux (Conectiva)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 4 Nov 2004 13:02:16 -0200
Subject: [Conectiva-updates] [CLA-2004:884] Conectiva Security Announcement
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : gaim
SUMMARY : Fixes for gaim's vulnerabilities
DATE : 2004-11-04 12:51:00
ID : CLA-2004:884
RELEVANT
RELEASES : 9, 10
- -------------------------------------------------------------------------
DESCRIPTION
Gaim[1] is a multi-protocol instant messaging (IM) client.
This announcement fixes several denial of service and buffer overflow
vulnerabilities that were encountered in Gaim.
The fixed vulnerabilities are:
CAN-2004-0500[2]: Buffer overflow in the MSN protocol plugins
object.c and slp.c allows remote attackers to cause a denial of
service and possibly execute arbitrary code via MSNSLP protocol
messages that are not properly handled in a strncpy call.
CAN-2004-0754[3]: Integer overflow in Gaim allows remote attackers to
cause a denial of service and possibly execute arbitrary code via the
size variable in Groupware server messages.
CAN-2004-0784[4]: The smiley theme functionality in Gaim allows
remote attackers to execute arbitrary commands via shell
metacharacters in the filename of the tar file that is dragged to the
smiley selector.
CAN-2004-0785[5]: Multiple buffer overflows in Gaim allow remote
attackers to cause a denial of service and possibly execute arbitrary
code via Rich Text Format (RTF) messages, a long hostname for the
local system as obtained from DNS, or a long URL that is not properly
handled by the URL decoder.
For further informations on Gaim's vulnerabilities, please refer to
the project's security page[6].
SOLUTION
It is recommended that all Gaim users upgrade their packages.
IMPORTANT: Gaim must be restarted after the upgrade in order to close
the vulnerabilities.
REFERENCES
1.http://gaim.sourceforge.net/
2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0500
3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0754
4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0784
5.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0785
6.http://gaim.sourceforge.net/security/
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/10/SRPMS/gaim-1.0.2-69982U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-am-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-bg-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ca-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-cs-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-da-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-de-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-en_AU-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-en_CA-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-en_GB-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-es-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-fi-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-fr-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-he-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-hi-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-hu-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-it-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ja-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ko-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-lt-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-mk-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-nl-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-no-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-pl-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-pt-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-pt_BR-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ro-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-ru-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-sk-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-sl-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-sr-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-sv-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-vi-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-zh_CN-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gaim-i18n-zh_TW-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libgaim-remote-devel-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libgaim-remote0-1.0.2-69982U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/gaim-1.0.2-27683U90_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/gaim-1.0.2-27683U90_2cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com
- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQFBikR342jd0JmAcZARAhnlAKDd+XbZWxNs4gUSJDBEo4lcvyneQQCfSFWT
E4gDh1wwCcWxorLENN8wLn8=
=qlfL
-----END PGP SIGNATURE-----
______________________________________________________________________
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
|
|
