Gaim 1.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed MSN message.

An updated gaim package that fixes two security issues is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

A stack based buffer overflow bug was found in the way gaim processes a message containing a URL. A remote attacker could send a carefully crafted message resulting in the execution of arbitrary code on a victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1261 to this issue.

A bug was found in the way gaim handles malformed MSN messages. A remote attacker could send a carefully crafted MSN message causing gaim to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1262 to this issue.

Users of Gaim are advised to upgrade to this updated package which contains backported patches and is not vulnerable to these issues.

Marco Alvarez found a Denial of Service vulnerability in the Jabber protocol handler. A remote attacker could exploit this to crash Gaim by sending specially crafted file transfers to the user.
(CAN-2005-0967)

Stu Tomlinson discovered an insufficient bounds checking flaw in the URL parser. By sending a message containing a very long URL, a remote attacker could crash Gaim or execute arbitrary code with the privileges of the user. This was not possible on all protocols, due to message length restrictions. Jabber are SILC were known to be vulnerable. (CAN-2005-1261)

Siebe Tolsma discovered a Denial of Service attack in the MSN handler.
By sending a specially crafted SLP message with an empty body, a remote attacker could crash Gaim. (CAN-2005-1262).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The GAIM team reports :

Potential remote denial of service bug resulting from not checking a pointer for non-NULL before passing it to strncmp, which results in a crash. This can be triggered by a remote client sending an SLP message with an empty body.

More vulnerabilities have been found in the gaim instant messaging client. A stack-based buffer overflow bug was found in how gaim processes a message containing a URL; a remote attacker could send a carefully crafted message to cause the execution of arbitrary code on the user's machine (CVE-2005-1261).

Another bug was found in how gaim handles malformed MSN messages; an attacker could send a carefully crafted MSN message that would cause gaim to crash (CVE-2005-1262).

Gaim version 1.3.0 fixes these issues and is provided with this update.

The remote host is affected by the vulnerability described in GLSA-200505-09 (Gaim: Denial of Service and buffer overflow vulnerabilities)

    Stu Tomlinson discovered that Gaim is vulnerable to a remote stack     based buffer overflow when receiving messages in certain protocols,     like Jabber and SILC, with a very long URL (CAN-2005-1261). Siebe     Tolsma discovered that Gaim is also vulnerable to a remote Denial of     Service attack when receiving a specially crafted MSN message     (CAN-2005-1262).
  Impact :

    A remote attacker could cause a buffer overflow by sending an     instant message with a very long URL, potentially leading to the     execution of malicious code. By sending a SLP message with an empty     body, a remote attacker could cause a Denial of Service or crash of the     Gaim client.
  Workaround :

    There are no known workarounds at this time.

The remote host appears to be running Gaim, a popular open-source, multi-protocol instant messenger. It is reported that this version of Gaim is vulnerable to several remote flaws.  Namely

1) The MSN protocol module is vulnerable to a remote Denial of Service (DoS) attack when sent a NULL SLP message.  Successful exploitation results in the application crashing.

2) Gaim instant messages support the sending of links (URIs).  This version of Gaim only supports links of 8192 bytes or less.  An attacker sending a link of more than 8192 bytes can overwrite memory and execute arbitrary code.

ID	Name	Product	Family	Severity
21825	CentOS 3 / 4 : gaim (CESA-2005:429)	Nessus	CentOS Local Security Checks	high
20515	Ubuntu 4.10 / 5.04 : gaim vulnerabilities (USN-125-1)	Nessus	Ubuntu Local Security Checks	high
19077	FreeBSD : gaim -- MSN remote DoS vulnerability (ad5e70bb-c429-11d9-ac59-02061b08fc24)	Nessus	FreeBSD Local Security Checks	medium
18275	Mandrake Linux Security Advisory : gaim (MDKSA-2005:086)	Nessus	Mandriva Local Security Checks	high
18252	GLSA-200505-09 : Gaim: Denial of Service and buffer overflow vulnerabilities	Nessus	Gentoo Local Security Checks	high
2894	Gaim < 1.3.0 Multiple Vulnerabilities	Nessus Network Monitor	Internet Messengers	medium
18240	RHEL 3 / 4 : gaim (RHSA-2005:429)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2005-1262

high

Tenable Plugins

high

high

medium

high

high

medium

high