Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the name, which is not properly handled in a call to the gnomemeeting_log_insert function.

From Red Hat Security Advisory 2007:0086 :

Updated gnomemeeting packages that fix a security issue are now available for Red Hat Enterprise Linux.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

GnomeMeeting is a tool to communicate with video and audio over the Internet.

A format string flaw was found in the way GnomeMeeting processes certain messages. If a user is running GnomeMeeting, a remote attacker who can connect to GnomeMeeting could trigger this flaw and potentially execute arbitrary code with the privileges of the user.
(CVE-2007-1007)

Users of GnomeMeeting should upgrade to these updated packages which contain a backported patch to correct this issue.

This update fixes format string problems in gnomemeeting which might be used by remote attackers to crash gnomemeeting and on older distributions potentially execute code. (CVE-2007-1007)

Mu Security discovered a format string vulnerability in Ekiga. If a user was running Ekiga and listening for incoming calls, a remote attacker could send a crafted call request, and execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes format string problems in gnomemeeting.
(CVE-2007-1007)

'Mu Security' discovered that a format string vulnerability in the VoIP solution GnomeMeeting allows the execution of arbitrary code.

Updated gnomemeeting packages that fix a security issue are now available for Red Hat Enterprise Linux.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

GnomeMeeting is a tool to communicate with video and audio over the Internet.

A format string flaw was found in the way GnomeMeeting processes certain messages. If a user is running GnomeMeeting, a remote attacker who can connect to GnomeMeeting could trigger this flaw and potentially execute arbitrary code with the privileges of the user.
(CVE-2007-1007)

Users of GnomeMeeting should upgrade to these updated packages which contain a backported patch to correct this issue.

ID	Name	Product	Family	Severity
67457	Oracle Linux 3 / 4 : gnomemeeting (ELSA-2007-0086)	Nessus	Oracle Linux Local Security Checks	critical
29446	SuSE 10 Security Update : gnomemeeting (ZYPP Patch Number 3163)	Nessus	SuSE Local Security Checks	critical
28019	Ubuntu 5.10 / 6.06 LTS / 6.10 : ekiga, gnomemeeting vulnerabilities (USN-426-1)	Nessus	Ubuntu Local Security Checks	critical
27241	openSUSE 10 Security Update : gnomemeeting (gnomemeeting-3162)	Nessus	SuSE Local Security Checks	critical
24765	Debian DSA-1262-1 : gnomemeeting - format string	Nessus	Debian Local Security Checks	critical
24678	RHEL 3 / 4 : gnomemeeting (RHSA-2007:0086)	Nessus	Red Hat Local Security Checks	critical
24674	CentOS 3 / 4 : gnomemeeting (CESA-2007:0086)	Nessus	CentOS Local Security Checks	critical

Detections

Analytics

CVE-2007-1007

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical