libgadu before 1.8.2 allows remote servers to cause a denial of service (crash) via a contact description with a large length, which triggers a buffer over-read.

The remote host is affected by the vulnerability described in GLSA-201412-10 (Multiple packages, Multiple vulnerabilities fixed in 2012)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      EGroupware       VTE       Layer Four Traceroute (LFT)       Suhosin       Slock       Ganglia       Jabber to GaduGadu Gateway   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

This update of kdenetwork fixes several bugs, the security related issues are :

  - CVE-2010-1000: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:P/A:N): CWE-22 The 'name'     attribute of the 'file' element of metalink files is not     properly sanitised this can be exploited to download     files to arbitrary directories.

Non-security issues :

  - bnc#653852: kopete: ICQ login broken; login server     changed

This update of kdenetwork fixes several bugs, the security related issues are :

  - CVE-2008-4776: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): CWE-119 The included     libgadu version allowed remote servers to cause a denial     of service (crash) via a buffer over-read.

Non-security issues :

  - bnc#653852: kopete: ICQ login broken; login server     changed

  - bnc#516347: kopete cant connect to yahoo

This update of kdenetwork fixes several bugs, the security related issues are :

  - CVE-2010-1000: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:P/A:N): CWE-22 The 'name'     attribute of the 'file' element of metalink files is not     properly sanitised this can be exploited to download     files to arbitrary directories.

  - CVE-2008-4776: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): CWE-119 The included     libgadu version allowed remote servers to cause a denial     of service (crash) via a buffer over-read.

Non-security issues :

  - bnc#653852: kopete: ICQ login broken; login server     changed

  - bnc#516347: kopete cant connect to yahoo

This update of kdenetwork fixes several bugs, the security related issues are :

  - CWE-119 The included libgadu version allowed remote     servers to cause a denial of service (crash) via a     buffer over-read. (CVE-2008-4776: CVSS v2 Base Score:
    4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P))

Non-security issues :

  - kopete: ICQ login broken; login server changed.
    (bnc#653852)

  - kopete icq does not display nicknames correctly.
    (bnc#463442)

This update of kdenetwork fixes several bugs, the security related issues are :

  - The 'name' attribute of the 'file' element of metalink     files is not properly sanitised this can be exploited to     download files to arbitrary directories. (CVE-2010-1000:
    CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N):
    CWE-22)

  - The included libgadu version allowed remote servers to     cause a denial of service (crash) via a buffer     over-read. (CVE-2008-4776: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): CWE-119)

Non-security issues :

  - kopete: ICQ login broken; login server changed.
    (bnc#653852)

  - kopete cant connect to yahoo. (bnc#516347)

A vulnerability has been found and corrected in libgadu :

libgadu before 1.8.2 allows remote servers to cause a denial of service (crash) via a contact description with a large length, which triggers a buffer over-read (CVE-2008-4776).

This update provides a solution to this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update fixes a remote denial of service bug in libgadu.
(CVE-2008-4776)

It was discovered that the Gadu library, used by some Instant Messaging clients, did not correctly verify certain packet sizes from the server. If a user connected to a malicious server, clients using Gadu could be made to crash, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ekg, a console Gadu Gadu client performs insufficient input sanitising in the code to parse contact descriptions, which may result in denial of service.

ID	Name	Product	Family	Severity
79963	GLSA-201412-10 : Multiple packages, Multiple vulnerabilities fixed in 2012	Nessus	Gentoo Local Security Checks	high
75547	openSUSE Security Update : kdenetwork4 (openSUSE-SU-2010:1076-1)	Nessus	SuSE Local Security Checks	medium
53739	openSUSE Security Update : kdenetwork4 (openSUSE-SU-2010:1076-1)	Nessus	SuSE Local Security Checks	medium
53668	openSUSE Security Update : kdenetwork3 (openSUSE-SU-2010:1085-1)	Nessus	SuSE Local Security Checks	medium
53664	openSUSE Security Update : kde4-kdnssd (openSUSE-SU-2010:1077-1)	Nessus	SuSE Local Security Checks	medium
51364	SuSE 10 Security Update : kdenetwork (ZYPP Patch Number 7245)	Nessus	SuSE Local Security Checks	medium
51199	SuSE 11 / 11.1 Security Update : kdenetwork (SAT Patch Numbers 3563 / 3564)	Nessus	SuSE Local Security Checks	medium
40693	Mandriva Linux Security Advisory : libgadu (MDVSA-2009:208-1)	Nessus	Mandriva Local Security Checks	medium
40024	openSUSE Security Update : libgadu (libgadu-272)	Nessus	SuSE Local Security Checks	medium
36984	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : ekg, libgadu vulnerability (USN-692-1)	Nessus	Ubuntu Local Security Checks	medium
34745	Debian DSA-1664-1 : ekg - missing input sanitising	Nessus	Debian Local Security Checks	medium
34679	openSUSE 10 Security Update : libgadu (libgadu-5717)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2008-4776

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium