Gaim Buffer Overflows in Groupware Messages, URLs, Hostname Lookups, and RTF Messages May Permit Remote Code Execution
|
|
SecurityTracker Alert ID: 1011083
|
|
SecurityTracker URL: http://securitytracker.com/id?1011083
|
|
CVE Reference: CAN-2004-0785
, CAN-2004-0754
(Links to External Site)
|
|
OSVDB Reference: 9260
, 9261
, 9262
, 9263
, 9264
(Links to External Site)
|
Date: Aug 28 2004
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 0.82
|
Description: Several overflow vulnerabilities were reported in Gaim. A remote user may be able to execute arbitrary code on the target system. A remote server can also cause the Gaim client to crash.
The vendor reported that a remote groupware server can send specially crafted messages to a target client to trigger a memory allocation
integer overflow [CVE: CAN-2004-0754]. The resulting heap overflow may allow arbitrary code to be executed.
It is also reported
that a remote user can send a specially crafted URL that, when received by the target user, will overflow a static buffer of 2048
bytes [CVE: CAN-2004-0785].
It is also reported that a hostname lookup overflow can be triggered [CVE: CAN-2004-0785]. If the
DNS server returns a hostname that is greater than MAXHOSTNAMELEN bytes, a buffer overflow will occur.
It is also reported that
a remote user can create an invalid rich text format (RTF) message to trigger one of several buffer overflows [CVE: CAN-2004-0785].
It
is also reported that a remote web server can return a large HTTP Content-Length header value to cause the target user's Gaim to
crash. This can be triggered if the supplied length value is large enough to cause Gaim to consume all available memory. This
can occur when Gaim reads profile information on some protocols and when smiley themes are installed via drag and drop.
The original
advisories are available at:
http://gaim.sourceforge.net/security/index.php?id=2
http://gaim.sourceforge.net/security/index.php?id=3
http://gaim.sourceforge.net/secu
rity/index.php?id=4
http://gaim.sourceforge.net/security/index.php?id=5
http://gaim.sourceforge.net/security/index.php?id=6
|
Impact: A remote user can cause arbitrary code to be executed on the target application or cause the application to crash.
|
Solution: The vendor has released a fixed version (0.82), available at:
http://gaim.sourceforge.net/downloads.php
|
Vendor URL: gaim.sourceforge.net/security/ (Links to External Site)
|
Cause: Boundary error, Input validation error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Aug 22, 2004
Subject: Gaim overflows
|
http://gaim.sourceforge.net/security/index.php?id=2
http://gaim.sourceforge.net/security/index.php?id=3
http://gaim.sourceforge.net/security/index.php?id=4
http://gaim.sourceforge.net/security/index.php?id=5
http://gaim.sourceforge.net/security/index.php?id=6
Several vulnerabilities were reported in Gaim. A remote user may be able to execute
arbitrary code on the target system.
The vendor reported that a remote groupware server can send specially crafted messages
to a target client to trigger an memory allocation integer overflow [CVE:
CAN-2004-0754]. The resulting heap overflow may allow arbitrary code to be executed.
It is also reported that a remote user can send a specially crafted URL that, when
received by the target user, will overflow a static buffer of 2048 bytes [CVE:
CAN-2004-0785].
It is also reported that a hostname lookup overflow can be triggered [CVE:
CAN-2004-0785]. If the DNS server returns a hostname that is greater than
MAXHOSTNAMELEN bytes, a buffer overflow will occur.
It is also reported that a remote user can create an invalid rich text format (RTF)
message to trigger one of several buffer overflows [CVE: CAN-2004-0785].
It is also reported that a remote web server can return a large HTTP
Content-Length header value to cause the target user's Gaim to crash. This can be
triggered if the supplied length value cause Gaim to consume all available memory.
This can occur when Gaim reads profile information on some protocols and when smiley
themes are installed via drag and drop.
|
|
