GLSA Bodhisattva
Joined: 13 Jun 2003 Posts: 4087 Location: Dresden, Germany
|
Posted: Thu Aug 12, 2004 9:50 pm Post subject: [ GLSA 200408-12 ] Gaim: MSN protocol parsing function buffe |
|
|
Gentoo Linux Security Advisory
Title: Gaim: MSN protocol parsing function buffer overflow (GLSA 200408-12)
Severity: normal
Exploitable: remote
Date: August 12, 2004
Updated: May 22, 2006
Bug(s): #60034
ID: 200408-12
Synopsis
Gaim contains a remotely exploitable buffer overflow vulnerability in the MSN-protocol parsing code that may allow remote execution of arbitrary code.
Background
Gaim is a multi-protocol instant messaging client for Linux which supports many instant messaging protocols.
Affected Packages
Package: net-im/gaim
Vulnerable: <= 0.81
Unaffected: >= 0.81-r1
Architectures: All supported architectures
Description
Sebastian Krahmer of the SuSE Security Team has discovered a remotely exploitable buffer overflow vulnerability in the code handling MSN protocol parsing.
Impact
By sending a carefully-crafted message, an attacker may execute arbitrary code with the permissions of the user running Gaim.
Workaround
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of Gaim.
Resolution
All Gaim users should upgrade to the latest version: Code: | # emerge sync
# emerge -pv ">=net-im/gaim-0.81-r1"
# emerge ">=net-im/gaim-0.81-r1" |
References
OSVDB ID: 8382
CVE-2004-0500
Last edited by GLSA on Thu Nov 23, 2006 4:16 am; edited 4 times in total |
|