RHEL 3 / 4 : gaim (RHSA-2005:627)

This script is Copyright (C) 2005-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

An updated gaim package that fixes multiple security issues is now
available.

This update has been rated as having critical security impact by the
Red Hat Security Response Team.

Gaim is an Internet Messaging client.

A heap based buffer overflow issue was discovered in the way Gaim
processes away messages. A remote attacker could send a specially
crafted away message to a Gaim user logged into AIM or ICQ that could
result in arbitrary code execution. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-2103
to this issue.

Daniel Atallah discovered a denial of service issue in Gaim. A remote
attacker could attempt to upload a file with a specially crafted name
to a user logged into AIM or ICQ, causing Gaim to crash. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2005-2102 to this issue.

A denial of service bug was found in Gaim's Gadu Gadu protocol
handler. A remote attacker could send a specially crafted message to a
Gaim user logged into Gadu Gadu, causing Gaim to crash. Please note
that this issue only affects PPC and IBM S/390 systems running Gaim.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2005-2370 to this issue.

Users of gaim are advised to upgrade to this updated package, which
contains backported patches and is not vulnerable to these issues.

See also :

https://www.redhat.com/security/data/cve/CVE-2005-2102.html
https://www.redhat.com/security/data/cve/CVE-2005-2103.html
https://www.redhat.com/security/data/cve/CVE-2005-2370.html
http://rhn.redhat.com/errata/RHSA-2005-627.html

Solution :

Update the affected gaim package.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: Red Hat Local Security Checks

Nessus Plugin ID: 19423 ()

Bugtraq ID:

CVE ID: CVE-2005-2102
CVE-2005-2103
CVE-2005-2370