RHEL 2.1 : gaim (RHSA-2004:045)

High Nessus Plugin ID 12459


The remote Red Hat host is missing a security update.


Updated Gaim packages that fix a pair of security vulnerabilities are now available.

Gaim is an instant messenger client that can handle multiple protocols.

Stefan Esser audited the Gaim source code and found a number of bugs that have security implications. Many of these bugs do not affect the version of Gaim distributed with version 2.1 of Red Hat Enterprise Linux.

A buffer overflow exists in the HTTP Proxy connect code. If Gaim is configured to use an HTTP proxy for connecting to a server, a malicious HTTP proxy could run arbitrary code as the user running Gaim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0006 to this issue.

An integer overflow in Gaim 0.74 and earlier, when allocating memory for a directIM packet for AIM/Oscar, results in heap overflow. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0008 to this issue.

Users of Gaim should upgrade to these erratum packages, which contain a backported security patch correcting this issue.

Red Hat would like to thank Steffan Esser for finding and reporting these issues and Jacques A. Vidrine for providing initial patches.


Update the affected gaim package.

See Also





Plugin Details

Severity: High

ID: 12459

File Name: redhat-RHSA-2004-045.nasl

Version: $Revision: 1.21 $

Type: local

Agent: unix

Published: 2004/07/06

Modified: 2016/12/28

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:gaim, cpe:/o:redhat:enterprise_linux:2.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 2004/02/09

Reference Information

CVE: CVE-2004-0006, CVE-2004-0008

RHSA: 2004:045