Buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer.

A buffer overflow and two remote crashes were recently discovered in gaim's MSN protocol handler. An attacker could potentially execute arbitrary code with the user's privileges by crafting and sending a particular MSN message.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Due to a buffer overflow in the MSN protocol support for gaim 0.79 to 1.0.1, it is possible for remote clients to do a denial-of-service attack on the application. This is caused by an unbounded copy operation, which writes to the wrong buffer.

New gaim packages are available for Slackware 9.0, 9.1, 10.0 and
-current to fix a buffer overflow in the MSN protocol. Sites that use GAIM should upgrade to the new version.

A bug was discovered in the way that gtk+2.0 processes BMP images which could allow for a specially crafted BMP to cause a Denial of Service attack on applications linked against gtk+2.0.

The updated packages have been patched to correct these issues.

A vulnerability in the MSN protocol handler in the gaim instant messenger application was discovered. When receiving unexpected sequences of MSNSLP messages, it is possible that an attacker could trigger an internal buffer overflow which could lead to a crash or even code execution as the user running gaim.

The updated packages are patched to fix this problem. This problem does not affect Mandrakelinux 10.0 installations.

The remote host is affected by the vulnerability described in GLSA-200410-23 (Gaim: Multiple vulnerabilities)

    A possible buffer overflow exists in the code processing MSN SLP messages     (CAN-2004-0891). memcpy() was used without validating the size of the     buffer, and an incorrect buffer was used as destination under certain     circumstances. Additionally, memory allocation problems were found in the     processing of MSN SLP messages and the receiving of files. These issues     could lead Gaim to try to allocate more memory than available, resulting in     the crash of the application.
  Impact :

    A remote attacker could crash Gaim and possibly execute arbitrary code by     exploiting the buffer overflow.
  Workaround :

    There is no known workaround at this time.

An updated gaim package that fixes security issues, fixes various bugs, and includes various enhancements for Red Hat Enterprise Linux 3 is now available.

The gaim application is a multi-protocol instant messaging client.

A buffer overflow has been discovered in the MSN protocol handler.
When receiving unexpected sequence of MSNSLP messages, it is possible that an attacker could cause an internal buffer overflow, leading to a crash or possible code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0891 to this issue.

This updated gaim package also fixes multiple user interface, protocol, and error handling problems, including an ICQ communication encoding issue.

Additionally, these updated packages have compiled gaim as a PIE (position independent executable) for added protection against future security vulnerabilities.

All users of gaim should upgrade to this updated package, which includes various bug fixes, as well as a backported security patch.

ID	Name	Product	Family	Severity
20703	Ubuntu 4.10 : gaim vulnerabilities (USN-8-1)	Nessus	Ubuntu Local Security Checks	critical
18861	FreeBSD : gaim -- buffer overflow in MSN protocol support (1e6c4008-245f-11d9-b584-0050fc56d258)	Nessus	FreeBSD Local Security Checks	critical
18760	Slackware 10.0 / 9.0 / 9.1 / current : gaim (SSA:2004-296-01)	Nessus	Slackware Local Security Checks	critical
18003	Mandrake Linux Security Advisory : gtk+2.0 (MDKSA-2005:068)	Nessus	Mandriva Local Security Checks	critical
15597	Mandrake Linux Security Advisory : gaim (MDKSA-2004:117)	Nessus	Mandriva Local Security Checks	critical
15559	GLSA-200410-23 : Gaim: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
15532	RHEL 3 : gaim (RHSA-2004:604)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2004-0891

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical