Stack-based buffer overflow in the URL parsing function in Gaim before 1.3.0 allows remote attackers to execute arbitrary code via an instant message (IM) with a large URL.

An updated gaim package that fixes two security issues is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

A stack based buffer overflow bug was found in the way gaim processes a message containing a URL. A remote attacker could send a carefully crafted message resulting in the execution of arbitrary code on a victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1261 to this issue.

A bug was found in the way gaim handles malformed MSN messages. A remote attacker could send a carefully crafted MSN message causing gaim to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1262 to this issue.

Users of Gaim are advised to upgrade to this updated package which contains backported patches and is not vulnerable to these issues.

Marco Alvarez found a Denial of Service vulnerability in the Jabber protocol handler. A remote attacker could exploit this to crash Gaim by sending specially crafted file transfers to the user.
(CAN-2005-0967)

Stu Tomlinson discovered an insufficient bounds checking flaw in the URL parser. By sending a message containing a very long URL, a remote attacker could crash Gaim or execute arbitrary code with the privileges of the user. This was not possible on all protocols, due to message length restrictions. Jabber are SILC were known to be vulnerable. (CAN-2005-1261)

Siebe Tolsma discovered a Denial of Service attack in the MSN handler.
By sending a specially crafted SLP message with an empty body, a remote attacker could crash Gaim. (CAN-2005-1262).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The GAIM team reports that GAIM is vulnerable to a denial-of-service vulnerability which can cause GAIM to crash :

It is possible for a remote user to overflow a static buffer by sending an IM containing a very large URL (greater than 8192 bytes) to the Gaim user. This is not possible on all protocols, due to message length restrictions. Jabber are SILC are known to be vulnerable.

More vulnerabilities have been found in the gaim instant messaging client. A stack-based buffer overflow bug was found in how gaim processes a message containing a URL; a remote attacker could send a carefully crafted message to cause the execution of arbitrary code on the user's machine (CVE-2005-1261).

Another bug was found in how gaim handles malformed MSN messages; an attacker could send a carefully crafted MSN message that would cause gaim to crash (CVE-2005-1262).

Gaim version 1.3.0 fixes these issues and is provided with this update.

The remote host is affected by the vulnerability described in GLSA-200505-09 (Gaim: Denial of Service and buffer overflow vulnerabilities)

    Stu Tomlinson discovered that Gaim is vulnerable to a remote stack     based buffer overflow when receiving messages in certain protocols,     like Jabber and SILC, with a very long URL (CAN-2005-1261). Siebe     Tolsma discovered that Gaim is also vulnerable to a remote Denial of     Service attack when receiving a specially crafted MSN message     (CAN-2005-1262).
  Impact :

    A remote attacker could cause a buffer overflow by sending an     instant message with a very long URL, potentially leading to the     execution of malicious code. By sending a SLP message with an empty     body, a remote attacker could cause a Denial of Service or crash of the     Gaim client.
  Workaround :

    There are no known workarounds at this time.

The remote host appears to be running Gaim, a popular open-source, multi-protocol instant messenger. It is reported that this version of Gaim is vulnerable to several remote flaws.  Namely

1) The MSN protocol module is vulnerable to a remote Denial of Service (DoS) attack when sent a NULL SLP message.  Successful exploitation results in the application crashing.

2) Gaim instant messages support the sending of links (URIs).  This version of Gaim only supports links of 8192 bytes or less.  An attacker sending a link of more than 8192 bytes can overwrite memory and execute arbitrary code.

An updated gaim package that fixes security issues is now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

A stack based buffer overflow bug was found in the way gaim processes a message containing a URL. A remote attacker could send a carefully crafted message resulting in the execution of arbitrary code on a victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1261 to this issue.

A bug in the way Gaim processes SNAC packets was discovered. It is possible that a remote attacker could send a specially crafted SNAC packet to a Gaim client, causing the client to stop responding. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0472 to this issue.

Users of Gaim are advised to upgrade to this updated package which contains gaim version 0.59.9 with backported patches to correct these issues.

ID	Name	Product	Family	Severity
21825	CentOS 3 / 4 : gaim (CESA-2005:429)	Nessus	CentOS Local Security Checks	high
20515	Ubuntu 4.10 / 5.04 : gaim vulnerabilities (USN-125-1)	Nessus	Ubuntu Local Security Checks	high
19017	FreeBSD : gaim -- remote crash on some protocols (889061af-c427-11d9-ac59-02061b08fc24)	Nessus	FreeBSD Local Security Checks	high
18275	Mandrake Linux Security Advisory : gaim (MDKSA-2005:086)	Nessus	Mandriva Local Security Checks	high
18252	GLSA-200505-09 : Gaim: Denial of Service and buffer overflow vulnerabilities	Nessus	Gentoo Local Security Checks	high
2894	Gaim < 1.3.0 Multiple Vulnerabilities	Nessus Network Monitor	Internet Messengers	medium
18241	RHEL 2.1 : gaim (RHSA-2005:432)	Nessus	Red Hat Local Security Checks	high
18240	RHEL 3 / 4 : gaim (RHSA-2005:429)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2005-1261

critical

Tenable Plugins

high

high

high

high

high

medium

high

high