The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0208.

The Gaim developers discovered that the HTML parser did not sufficiently validate its input. This allowed a remote attacker to crash the Gaim client by sending certain malformed HTML messages.
(CAN-2005-0208, CAN-2005-0473)

Another lack of sufficient input validation was found in the 'Oscar' protocol handler which is used for ICQ and AIM. By sending specially crafted packets, remote users could trigger an infinite loop in Gaim which caused Gaim to become unresponsive and hang. (CAN-2005-0472).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The GAIM team reports :

Receiving malformed HTML can result in an invalid memory access causing Gaim to crash.

An updated gaim package that fixes various security issues as well as a number of bugs is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

Two HTML parsing bugs were discovered in Gaim. It is possible that a remote attacker could send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0208 and CVE-2005-0473 to these issues.

A bug in the way Gaim processes SNAC packets was discovered. It is possible that a remote attacker could send a specially crafted SNAC packet to a Gaim client, causing the client to stop responding. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0472 to this issue.

Additionally, various client crashes, memory leaks, and protocol issues have been resolved.

Users of Gaim are advised to upgrade to this updated package which contains Gaim version 1.1.4 and is not vulnerable to these issues.

Gaim versions prior to version 1.1.4 suffer from a few security issues such as the HTML parses not sufficiently validating its input. This allowed a remote attacker to crash the Gaim client be sending certain malformed HTML messages (CVE-2005-0208 and CVE-2005-0473).

As well, insufficient input validation was also discovered in the 'Oscar' protocol handler, used for ICQ and AIM. By sending specially crafted packets, remote users could trigger an inifinite loop in Gaim causing it to become unresponsive and hang (CVE-2005-0472).

Gaim 1.1.4 is provided and fixes these issues.

The remote host is affected by the vulnerability described in GLSA-200503-03 (Gaim: Multiple Denial of Service issues)

    Specially crafted SNAC packets sent by other instant-messaging     users can cause Gaim to loop endlessly (CAN-2005-0472). Malformed HTML     code could lead to invalid memory accesses (CAN-2005-0208 and     CAN-2005-0473).
  Impact :

    Remote attackers could exploit these issues, resulting in a Denial     of Service.
  Workaround :

    There is no known workaround at this time.

The remote host appears to be running Gaim, a popular open-source multi-protocol instant messenger. It is reported that this version of Gaim is prone to a flaw in the way that it handles malformed HTML data.  An attacker exploiting this flaw would need to be able to communicate with a vulnerable GAIM user. Upon successful exploitation, the Gaim client would stop responding.
There is a second issue with this version of Gaim that is similar to the first.  Specifically, downloaded files which include bracket characters like '(' or ')' will cause the client to crash.

The remote host appears to be running Gaim, a popular open-source multi-protocol instant messenger. It is reported that this version of Gaim is prone to multiple Denial of Service (DoS) vulnerabilities that may allow an attacker to disable this client remotely.  An attacker exploiting this flaw would need to be able to initiate a chat session with the Gaim client. A successful exploit would result in the Gaim client crashing.

ID	Name	Product	Family	Severity
20710	Ubuntu 4.10 : gaim vulnerabilities (USN-85-1)	Nessus	Ubuntu Local Security Checks	medium
18848	FreeBSD : gaim -- remote DoS on receiving malformed HTML (142353df-b5cc-11d9-a788-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
17310	RHEL 3 / 4 : gaim (RHSA-2005:215)	Nessus	Red Hat Local Security Checks	medium
17278	Mandrake Linux Security Advisory : gaim (MDKSA-2005:049)	Nessus	Mandriva Local Security Checks	medium
17250	GLSA-200503-03 : Gaim: Multiple Denial of Service issues	Nessus	Gentoo Local Security Checks	medium
2654	Gaim < 1.1.4 Remote DoS	Nessus Network Monitor	Internet Messengers	medium
2631	Gaim < 1.1.3 Multiple DoS Vulnerabilities	Nessus Network Monitor	Internet Messengers	medium

Detections

Analytics

CVE-2005-0473

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium