Gaim 1.2.0 allows remote attackers to cause a denial of service (application crash) via a malformed file transfer request to a Jabber user, which leads to an out-of-bounds read.

An updated gaim package that fixes multiple denial of service issues is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

A buffer overflow bug was found in the way gaim escapes HTML. It is possible that a remote attacker could send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0965 to this issue.

A bug was found in several of gaim's IRC processing functions. These functions fail to properly remove various markup tags within an IRC message. It is possible that a remote attacker could send a specially crafted message to a Gaim client connected to an IRC server, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0966 to this issue.

A bug was found in gaim's Jabber message parser. It is possible for a remote Jabber user to send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0967 to this issue.

In addition to these denial of service issues, multiple minor upstream bugfixes are included in this update.

Users of Gaim are advised to upgrade to this updated package which contains Gaim version 1.2.1 and is not vulnerable to these issues.

Marco Alvarez found a Denial of Service vulnerability in the Jabber protocol handler. A remote attacker could exploit this to crash Gaim by sending specially crafted file transfers to the user.
(CAN-2005-0967)

Stu Tomlinson discovered an insufficient bounds checking flaw in the URL parser. By sending a message containing a very long URL, a remote attacker could crash Gaim or execute arbitrary code with the privileges of the user. This was not possible on all protocols, due to message length restrictions. Jabber are SILC were known to be vulnerable. (CAN-2005-1261)

Siebe Tolsma discovered a Denial of Service attack in the MSN handler.
By sending a specially crafted SLP message with an empty body, a remote attacker could crash Gaim. (CAN-2005-1262).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The GAIM team reports :

A remote jabber user can cause Gaim to crash by sending a specific file transfer request.

More vulnerabilities have been discovered in the gaim instant messaging client :

A buffer overflow vulnerability was found in the way that gaim escapes HTML, allowing a remote attacker to send a specially crafted message to a gaim client and causing it to crash (CVE-2005-0965).

A bug was discovered in several of gaim's IRC processing functions that fail to properly remove various markup tags within an IRC message. This could allow a remote attacker to send specially crafted message to a gaim client connected to an IRC server, causing it to crash (CVE-2005-0966).

Finally, a problem was found in gaim's Jabber message parser that would allow a remote Jabber user to send a specially crafted message to a gaim client, bausing it to crash (CVE-2005-0967).

Gaim version 1.2.1 is not vulnerable to these issues and is provided with this update.

The remote host is affected by the vulnerability described in GLSA-200504-05 (Gaim: Denial of Service issues)

    Multiple vulnerabilities have been addressed in the latest release of     Gaim:
    A buffer overread in the gaim_markup_strip_html() function,     which is used when logging conversations (CAN-2005-0965).
    Markup tags are improperly escaped using Gaim's IRC plugin     (CAN-2005-0966).
    Sending a specially crafted file transfer request to a Gaim Jabber     user can trigger a crash (CAN-2005-0967).
  Impact :

    An attacker could possibly cause a Denial of Service by exploiting any     of these vulnerabilities.
  Workaround :

    There is no known workaround at this time.

The remote host seems to be running Gaim, a popular open-source multi-protocol instant messenger. It is reported that this version of Gaim is prone to a flaw in the way that it handles malformed HTML data.  Specifically, a content-parsing flaw in the 'gaim_markup_strip_html' function can cause the application to fail, leading to a loss of availability.  Further, there are reported flaws within the IRC and Jabber plugins that can lead to a remote Denial of Service.  In addition, it is reported that a flaw within the IRC plugin can allow the injection of Gaim scripting language commands.

ID	Name	Product	Family	Severity
21811	CentOS 3 / 4 : gaim (CESA-2005:365)	Nessus	CentOS Local Security Checks	medium
20515	Ubuntu 4.10 / 5.04 : gaim vulnerabilities (USN-125-1)	Nessus	Ubuntu Local Security Checks	high
19157	FreeBSD : gaim -- jabber remote crash (ecf68408-a9f5-11d9-a788-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18052	Mandrake Linux Security Advisory : gaim (MDKSA-2005:071)	Nessus	Mandriva Local Security Checks	medium
18019	RHEL 3 / 4 : gaim (RHSA-2005:365)	Nessus	Red Hat Local Security Checks	medium
17992	GLSA-200504-05 : Gaim: Denial of Service issues	Nessus	Gentoo Local Security Checks	medium
2793	Gaim < 1.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Messengers	medium

Detections

Analytics

CVE-2005-0967

high

Tenable Plugins

medium

high

medium

medium

medium

medium

medium