Executive Summary
Summary | |
---|---|
Title | Gaim vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-85-1 | First vendor Publication | 2005-02-25 |
Vendor | Ubuntu | Last vendor Modification | 2005-02-25 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
---|---|---|---|
Cvss Base Score | 5 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) The following packages are affected: gaim The problem can be corrected by upgrading the affected package to version 1:1.0.0-1ubuntu1.2. In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: The Gaim developers discovered that the HTML parser did not sufficiently validate its input. This allowed a remote attacker to crash the Gaim client by sending certain malformed HTML messages. (CAN-2005-0208, CAN-2005-0473) Another lack of sufficient input validation was found in the "Oscar" protocol handler which is used for ICQ and AIM. By sending specially crafted packets, remote users could trigger an infinite loop in Gaim which caused Gaim to become unresponsive and hang. (CAN-2005-0472) |
Original Source
Url : http://www.ubuntu.com/usn/USN-85-1 |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10212 | |||
Oval ID: | oval:org.mitre.oval:def:10212 | ||
Title: | The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0208. | ||
Description: | The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0208. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-0473 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:10433 | |||
Oval ID: | oval:org.mitre.oval:def:10433 | ||
Title: | Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ. | ||
Description: | Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-0472 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:10477 | |||
Oval ID: | oval:org.mitre.oval:def:10477 | ||
Title: | Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message. | ||
Description: | The HTML parsing functions in Gaim before 1.1.4 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0473. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-0208 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 6 | |
Os | 4 | |
Os | 2 | |
Os | 3 | |
Os | 1 |
OpenVAS Exploits
Date | Description |
---|---|
2008-09-24 | Name : Gentoo Security Advisory GLSA 200503-03 (gaim) File : nvt/glsa_200503_03.nasl |
2008-09-04 | Name : FreeBSD Ports: gaim, ja-gaim, ko-gaim, ru-gaim File : nvt/freebsd_gaim10.nasl |
2008-09-04 | Name : FreeBSD Ports: gaim, ja-gaim, ko-gaim, ru-gaim File : nvt/freebsd_gaim11.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 716-1 (gaim) File : nvt/deb_716_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
14204 | Gaim Malformed HTML Client DoS |
13924 | Gaim Malformed HTML Parsing DoS |
13923 | Gaim Malformed SNAC Packet Parsing DoS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2006-01-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-85-1.nasl - Type : ACT_GATHER_INFO |
2005-09-12 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-159.nasl - Type : ACT_GATHER_INFO |
2005-09-12 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-160.nasl - Type : ACT_GATHER_INFO |
2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_142353dfb5cc11d9a7880001020eed82.nasl - Type : ACT_GATHER_INFO |
2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_8b0e94ccb5cd11d9a7880001020eed82.nasl - Type : ACT_GATHER_INFO |
2005-05-11 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-432.nasl - Type : ACT_GATHER_INFO |
2005-04-28 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-716.nasl - Type : ACT_GATHER_INFO |
2005-03-10 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-215.nasl - Type : ACT_GATHER_INFO |
2005-03-06 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-049.nasl - Type : ACT_GATHER_INFO |
2005-03-02 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200503-03.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 12:06:20 |
|