Executive Summary
| Summary | |
|---|---|
| Title | gaim security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2005:215 | First vendor Publication | 2005-03-10 |
| Vendor | RedHat | Last vendor Modification | 2005-03-10 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: An updated gaim package that fixes various security issues as well as a number of bugs is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: The Gaim application is a multi-protocol instant messaging client. Two HTML parsing bugs were discovered in Gaim. It is possible that a remote attacker could send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2005-0208 and CAN-2005-0473 to these issues. A bug in the way Gaim processes SNAC packets was discovered. It is possible that a remote attacker could send a specially crafted SNAC packet to a Gaim client, causing the client to stop responding. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0472 to this issue. Additionally, various client crashes, memory leaks, and protocol issues have been resolved. Users of Gaim are advised to upgrade to this updated package which contains Gaim version 1.1.4 and is not vulnerable to these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/): 149273 - CAN-2005-0472 Gaim DoS issues (CAN-2005-0473) 149533 - CAN-2005-0208 Gaim HTML parsing DoS |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2005-215.html |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10212 | |||
| Oval ID: | oval:org.mitre.oval:def:10212 | ||
| Title: | The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0208. | ||
| Description: | The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0208. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0473 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:10433 | |||
| Oval ID: | oval:org.mitre.oval:def:10433 | ||
| Title: | Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ. | ||
| Description: | Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0472 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:10477 | |||
| Oval ID: | oval:org.mitre.oval:def:10477 | ||
| Title: | Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message. | ||
| Description: | The HTML parsing functions in Gaim before 1.1.4 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0473. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0208 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 6 | |
| Os | 4 | |
| Os | 2 | |
| Os | 3 | |
| Os | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200503-03 (gaim) File : nvt/glsa_200503_03.nasl |
| 2008-09-04 | Name : FreeBSD Ports: gaim, ja-gaim, ko-gaim, ru-gaim File : nvt/freebsd_gaim10.nasl |
| 2008-09-04 | Name : FreeBSD Ports: gaim, ja-gaim, ko-gaim, ru-gaim File : nvt/freebsd_gaim11.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 716-1 (gaim) File : nvt/deb_716_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 14204 | Gaim Malformed HTML Client DoS |
| 13924 | Gaim Malformed HTML Parsing DoS |
| 13923 | Gaim Malformed SNAC Packet Parsing DoS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-01-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-85-1.nasl - Type : ACT_GATHER_INFO |
| 2005-09-12 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-159.nasl - Type : ACT_GATHER_INFO |
| 2005-09-12 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-160.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_142353dfb5cc11d9a7880001020eed82.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_8b0e94ccb5cd11d9a7880001020eed82.nasl - Type : ACT_GATHER_INFO |
| 2005-05-11 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-432.nasl - Type : ACT_GATHER_INFO |
| 2005-04-28 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-716.nasl - Type : ACT_GATHER_INFO |
| 2005-03-10 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-215.nasl - Type : ACT_GATHER_INFO |
| 2005-03-06 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-049.nasl - Type : ACT_GATHER_INFO |
| 2005-03-02 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200503-03.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:49:07 |
|
