The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite, or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown, irc_msg_nochan functions.

An updated gaim package that fixes multiple denial of service issues is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

A buffer overflow bug was found in the way gaim escapes HTML. It is possible that a remote attacker could send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0965 to this issue.

A bug was found in several of gaim's IRC processing functions. These functions fail to properly remove various markup tags within an IRC message. It is possible that a remote attacker could send a specially crafted message to a Gaim client connected to an IRC server, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0966 to this issue.

A bug was found in gaim's Jabber message parser. It is possible for a remote Jabber user to send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0967 to this issue.

In addition to these denial of service issues, multiple minor upstream bugfixes are included in this update.

Users of Gaim are advised to upgrade to this updated package which contains Gaim version 1.2.1 and is not vulnerable to these issues.

Jean-Yves Lefort discovered a buffer overflow in the gaim_markup_strip_html() function. This caused Gaim to crash when receiving certain malformed HTML messages. (CAN-2005-0965)

Jean-Yves Lefort also noticed that many functions that handle IRC commands do not escape received HTML metacharacters; this allowed remote attackers to cause a Denial of Service by injecting arbitrary HTML code into the conversation window, popping up arbitrarily many empty dialog boxes, or even causing Gaim to crash. (CAN-2005-0966).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The GAIM team reports :

The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite, or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown, irc_msg_nochan functions.

More vulnerabilities have been discovered in the gaim instant messaging client :

A buffer overflow vulnerability was found in the way that gaim escapes HTML, allowing a remote attacker to send a specially crafted message to a gaim client and causing it to crash (CVE-2005-0965).

A bug was discovered in several of gaim's IRC processing functions that fail to properly remove various markup tags within an IRC message. This could allow a remote attacker to send specially crafted message to a gaim client connected to an IRC server, causing it to crash (CVE-2005-0966).

Finally, a problem was found in gaim's Jabber message parser that would allow a remote Jabber user to send a specially crafted message to a gaim client, bausing it to crash (CVE-2005-0967).

Gaim version 1.2.1 is not vulnerable to these issues and is provided with this update.

The remote host is affected by the vulnerability described in GLSA-200504-05 (Gaim: Denial of Service issues)

    Multiple vulnerabilities have been addressed in the latest release of     Gaim:
    A buffer overread in the gaim_markup_strip_html() function,     which is used when logging conversations (CAN-2005-0965).
    Markup tags are improperly escaped using Gaim's IRC plugin     (CAN-2005-0966).
    Sending a specially crafted file transfer request to a Gaim Jabber     user can trigger a crash (CAN-2005-0967).
  Impact :

    An attacker could possibly cause a Denial of Service by exploiting any     of these vulnerabilities.
  Workaround :

    There is no known workaround at this time.

The remote host seems to be running Gaim, a popular open-source multi-protocol instant messenger. It is reported that this version of Gaim is prone to a flaw in the way that it handles malformed HTML data.  Specifically, a content-parsing flaw in the 'gaim_markup_strip_html' function can cause the application to fail, leading to a loss of availability.  Further, there are reported flaws within the IRC and Jabber plugins that can lead to a remote Denial of Service.  In addition, it is reported that a flaw within the IRC plugin can allow the injection of Gaim scripting language commands.

ID	Name	Product	Family	Severity
21811	CentOS 3 / 4 : gaim (CESA-2005:365)	Nessus	CentOS Local Security Checks	medium
20492	Ubuntu 4.10 : gaim vulnerabilities (USN-106-1)	Nessus	Ubuntu Local Security Checks	medium
19153	FreeBSD : gaim -- remote DoS on receiving certain messages over IRC (ec09baa3-a9f5-11d9-a788-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18052	Mandrake Linux Security Advisory : gaim (MDKSA-2005:071)	Nessus	Mandriva Local Security Checks	medium
18019	RHEL 3 / 4 : gaim (RHSA-2005:365)	Nessus	Red Hat Local Security Checks	medium
17992	GLSA-200504-05 : Gaim: Denial of Service issues	Nessus	Gentoo Local Security Checks	medium
2793	Gaim < 1.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Messengers	medium

Detections

Analytics

CVE-2005-0966

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium