Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ.

The Gaim developers discovered that the HTML parser did not sufficiently validate its input. This allowed a remote attacker to crash the Gaim client by sending certain malformed HTML messages.
(CAN-2005-0208, CAN-2005-0473)

Another lack of sufficient input validation was found in the 'Oscar' protocol handler which is used for ICQ and AIM. By sending specially crafted packets, remote users could trigger an infinite loop in Gaim which caused Gaim to become unresponsive and hang. (CAN-2005-0472).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The GAIM team reports that GAIM is vulnerable to a denial-of-service vulnerability which can cause GAIM to freeze :

Certain malformed SNAC packets sent by other AIM or ICQ users can trigger an infinite loop in Gaim when parsing the SNAC. The remote user would need a custom client, able to generate malformed SNACs.

An updated gaim package that fixes security issues is now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

A stack based buffer overflow bug was found in the way gaim processes a message containing a URL. A remote attacker could send a carefully crafted message resulting in the execution of arbitrary code on a victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1261 to this issue.

A bug in the way Gaim processes SNAC packets was discovered. It is possible that a remote attacker could send a specially crafted SNAC packet to a Gaim client, causing the client to stop responding. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0472 to this issue.

Users of Gaim are advised to upgrade to this updated package which contains gaim version 0.59.9 with backported patches to correct these issues.

It has been discovered that certain malformed SNAC packets sent by other AIM or ICQ users can trigger an infinite loop in Gaim, a multi-protocol instant messaging client, and hence lead to a denial of service of the client.

Two more denial of service conditions have been discovered in newer versions of Gaim which are fixed in the package in sid but are not present in the package in woody.

An updated gaim package that fixes various security issues as well as a number of bugs is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

Two HTML parsing bugs were discovered in Gaim. It is possible that a remote attacker could send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0208 and CVE-2005-0473 to these issues.

A bug in the way Gaim processes SNAC packets was discovered. It is possible that a remote attacker could send a specially crafted SNAC packet to a Gaim client, causing the client to stop responding. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0472 to this issue.

Additionally, various client crashes, memory leaks, and protocol issues have been resolved.

Users of Gaim are advised to upgrade to this updated package which contains Gaim version 1.1.4 and is not vulnerable to these issues.

Gaim versions prior to version 1.1.4 suffer from a few security issues such as the HTML parses not sufficiently validating its input. This allowed a remote attacker to crash the Gaim client be sending certain malformed HTML messages (CVE-2005-0208 and CVE-2005-0473).

As well, insufficient input validation was also discovered in the 'Oscar' protocol handler, used for ICQ and AIM. By sending specially crafted packets, remote users could trigger an inifinite loop in Gaim causing it to become unresponsive and hang (CVE-2005-0472).

Gaim 1.1.4 is provided and fixes these issues.

The remote host is affected by the vulnerability described in GLSA-200503-03 (Gaim: Multiple Denial of Service issues)

    Specially crafted SNAC packets sent by other instant-messaging     users can cause Gaim to loop endlessly (CAN-2005-0472). Malformed HTML     code could lead to invalid memory accesses (CAN-2005-0208 and     CAN-2005-0473).
  Impact :

    Remote attackers could exploit these issues, resulting in a Denial     of Service.
  Workaround :

    There is no known workaround at this time.

The remote host appears to be running Gaim, a popular open-source multi-protocol instant messenger. It is reported that this version of Gaim is prone to a flaw in the way that it handles malformed HTML data.  An attacker exploiting this flaw would need to be able to communicate with a vulnerable GAIM user. Upon successful exploitation, the Gaim client would stop responding.
There is a second issue with this version of Gaim that is similar to the first.  Specifically, downloaded files which include bracket characters like '(' or ')' will cause the client to crash.

The remote host appears to be running Gaim, a popular open-source multi-protocol instant messenger. It is reported that this version of Gaim is prone to multiple Denial of Service (DoS) vulnerabilities that may allow an attacker to disable this client remotely.  An attacker exploiting this flaw would need to be able to initiate a chat session with the Gaim client. A successful exploit would result in the Gaim client crashing.

ID	Name	Product	Family	Severity
20710	Ubuntu 4.10 : gaim vulnerabilities (USN-85-1)	Nessus	Ubuntu Local Security Checks	medium
19020	FreeBSD : gaim -- AIM/ICQ remote denial of service vulnerability (8b0e94cc-b5cd-11d9-a788-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18241	RHEL 2.1 : gaim (RHSA-2005:432)	Nessus	Red Hat Local Security Checks	high
18152	Debian DSA-716-1 : gaim - denial of service	Nessus	Debian Local Security Checks	medium
17310	RHEL 3 / 4 : gaim (RHSA-2005:215)	Nessus	Red Hat Local Security Checks	medium
17278	Mandrake Linux Security Advisory : gaim (MDKSA-2005:049)	Nessus	Mandriva Local Security Checks	medium
17250	GLSA-200503-03 : Gaim: Multiple Denial of Service issues	Nessus	Gentoo Local Security Checks	medium
2654	Gaim < 1.1.4 Remote DoS	Nessus Network Monitor	Internet Messengers	medium
2631	Gaim < 1.1.3 Multiple DoS Vulnerabilities	Nessus Network Monitor	Internet Messengers	medium

Detections

Analytics

CVE-2005-0472

high

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium

medium