The URL handler in the manual browser option for Gaim before 0.59.1 allows remote attackers to execute arbitrary script via shell metacharacters in a link.

The developers of Gaim, an instant messenger client that combines several different networks, found a vulnerability in the hyperlink handling code. The 'Manual' browser command passes an untrusted string to the shell without escaping or reliable quoting, permitting an attacker to execute arbitrary commands on the users machine.
Unfortunately, Gaim doesn't display the hyperlink before the user clicks on it. Users who use other inbuilt browser commands aren't vulnerable.

The remote host seems to be running Gaim, a popular open-source multi-protocol instant messenger. It is reported that this version of Gaim is prone to a remote command execution issue. An attacker may send malicious code encoded in hyperlinks in instant messages that will be executed by the remote host.

Versions of Gaim (an AOL instant message client) prior to 0.58 contain a buffer overflow in the Jabber plug-in module. As well, a vulnerability was discovered in the URL-handling code, where the 'manual' browser command passes an untrusted string to the shell without reliable quoting or escaping. This allows an attacker to execute arbitrary commands on the user's machine with the user's permissions. Those using the built-in browser commands are not vulnerable.

Update :

The 8.1 package had an incorrect dependency on perl. This package has been replaced with a proper package. Please note the differing md5 sums.

Updated gaim packages are now available for Red Hat Linux Advanced Server. These updates fix a vulnerability in the default URL handler.

Gaim is an all-in-one instant messaging client that lets you use a number of messaging protocols such as AIM, ICQ, and Yahoo, all at once.

Versions of gaim prior to 0.59.1 contain a bug in the URL handler of the manual browser option. A link can be carefully crafted to contain an arbitrary shell script which will be executed if the user clicks on the link.

Users of gaim should update to these errata packages containing gaim 0.59.1 which is not vulnerable to this issue.

ID	Name	Product	Family	Severity
14995	Debian DSA-158-1 : gaim - arbitrary program execution	Nessus	Debian Local Security Checks	high
2162	Gaim < 0.59.1 Remote Command Execution	Nessus Network Monitor	Internet Messengers	medium
13956	Mandrake Linux Security Advisory : gaim (MDKSA-2002:054-1)	Nessus	Mandriva Local Security Checks	high
12323	RHEL 2.1 : gaim (RHSA-2002:191)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2002-0989

critical

Tenable Plugins

high

medium

high

high