Detections
Analytics

Mandrake Linux Security Advisory : gaim (MDKSA-2002:054-1)

high Nessus Plugin ID 13956

Synopsis

The remote Mandrake Linux host is missing a security update.

Description

Versions of Gaim (an AOL instant message client) prior to 0.58 contain a buffer overflow in the Jabber plug-in module. As well, a vulnerability was discovered in the URL-handling code, where the 'manual' browser command passes an untrusted string to the shell without reliable quoting or escaping. This allows an attacker to execute arbitrary commands on the user's machine with the user's permissions. Those using the built-in browser commands are not vulnerable.

Update :

The 8.1 package had an incorrect dependency on perl. This package has been replaced with a proper package. Please note the differing md5 sums.

Solution

Update the affected gaim package.

See Also

http://gaim.sourceforge.net/ChangeLog

Plugin Details

Severity: High

ID: 13956

File Name: mandrake_MDKSA-2002-054.nasl

Version: 1.25

Type: local

Published: 7/31/2004

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:gaim, cpe:/o:mandrakesoft:mandrake_linux:8.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 9/5/2002

Vulnerability Publication Date: 8/7/2002

Reference Information

CVE: CVE-2002-0384, CVE-2002-0989

BID: 5406, 5574

MDKSA: 2002:054-1