Message-ID: <4400708C.9090604@videotron.ca>
Date: Sat, 25 Feb 2006 09:58:20 -0500
From: Marc Deslauriers <marcdeslauriers@...eotron.ca>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [FLSA-2006:158543] Updated gaim package fixes
	security issues

---------------------------------------------------------------------
               Fedora Legacy Update Advisory

Synopsis:          Updated gaim package fixes security issues
Advisory ID:       FLSA:158543
Issue date:        2006-02-25
Products:          Red Hat Linux, Fedora Core
Keywords:          Bugfix
CVE Names:         CVE-2005-0208 CVE-2005-0473 CVE-2005-0472 CVE-2005-0965
		   CVE-2005-0966 CVE-2005-0967 CVE-2005-1261 CVE-2005-1262
		   CVE-2005-2103 CVE-2005-2102 CVE-2005-2370 CVE-2005-1269
		   CVE-2005-1934
---------------------------------------------------------------------


---------------------------------------------------------------------
1. Topic:

An updated gaim package that fixes various security issues as well as a
number of bugs is now available.

The Gaim application is a multi-protocol instant messaging client.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386

3. Problem description:

Two HTML parsing bugs were discovered in Gaim. It is possible that a
remote attacker could send a specially crafted message to a Gaim client,
causing it to crash. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the names CVE-2005-0208 and CVE-2005-0473
to these issues.

A bug in the way Gaim processes SNAC packets was discovered. It is
possible that a remote attacker could send a specially crafted SNAC
packet to a Gaim client, causing the client to stop responding. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2005-0472 to this issue.

A buffer overflow bug was found in the way gaim escapes HTML. It is
possible that a remote attacker could send a specially crafted message
to a Gaim client, causing it to crash. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-0965
to this issue.

A bug was found in several of gaim's IRC processing functions. These
functions fail to properly remove various markup tags within an IRC
message. It is possible that a remote attacker could send a specially
crafted message to a Gaim client connected to an IRC server, causing it
to crash. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2005-0966 to this issue.

A bug was found in gaim's Jabber message parser. It is possible for a
remote Jabber user to send a specially crafted message to a Gaim client,
causing it to crash. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2005-0967 to this issue.

A stack based buffer overflow bug was found in the way gaim processes a
message containing a URL. A remote attacker could send a carefully
crafted message resulting in the execution of arbitrary code on a
victim's machine. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2005-1261 to this issue.

A bug was found in the way gaim handles malformed MSN messages. A remote
attacker could send a carefully crafted MSN message causing gaim to
crash. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2005-1262 to this issue.

A heap based buffer overflow issue was discovered in the way Gaim
processes away messages. A remote attacker could send a specially
crafted away message to a Gaim user logged into AIM or ICQ that could
result in arbitrary code execution. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-2103 to
this issue.

Daniel Atallah discovered a denial of service issue in Gaim. A remote
attacker could attempt to upload a file with a specially crafted name to
a user logged into AIM or ICQ, causing Gaim to crash. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2005-2102 to this issue.

A denial of service bug was found in Gaim's Gadu Gadu protocol handler.
A remote attacker could send a specially crafted message to a Gaim user
logged into Gadu Gadu, causing Gaim to crash. Please note that this
issue only affects PPC and IBM S/390 systems running Gaim. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2005-2370 to this issue.

Jacopo Ottaviani discovered a bug in the way Gaim handles Yahoo!
Messenger file transfers. It is possible for a malicious user to send a
specially crafted file transfer request that causes Gaim to crash. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2005-1269 to this issue.

Additionally, Hugo de Bokkenrijder discovered a bug in the way Gaim
parses MSN Messenger messages. It is possible for a malicious user to
send a specially crafted MSN Messenger message that causes Gaim to
crash. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2005-1934 to this issue.

Additionally, various client crashes, memory leaks, and protocol issues
have been resolved.

Users of Gaim are advised to upgrade to this updated package which
contains Gaim version 1.5.0 and is not vulnerable to these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which
are not installed but included in the list will not be updated.  Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.

Please note that this update is also available via yum and apt.  Many
people find this an easier way to apply updates.  To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.  This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=158543

6. RPMs required:

Red Hat Linux 7.3:

SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gaim-1.5.0-0.73.1.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/gaim-1.5.0-0.73.1.legacy.i386.rpm

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gaim-1.5.0-0.90.1.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/gaim-1.5.0-0.90.1.legacy.i386.rpm

Fedora Core 1:

SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/gaim-1.5.0-1.fc1.1.legacy.src.rpm

i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/gaim-1.5.0-1.fc1.1.legacy.i386.rpm

Fedora Core 2:

SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/gaim-1.5.0-1.fc2.1.legacy.src.rpm

i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/gaim-1.5.0-1.fc2.1.legacy.i386.rpm


7. Verification:

SHA1 sum                                  Package Name
---------------------------------------------------------------------

a51c47a7e69e2ae0de301b5aea04a078a34bd494
redhat/7.3/updates/i386/gaim-1.5.0-0.73.1.legacy.i386.rpm
cf664d6dea2391a620286c2a0558f344128dc09b
redhat/7.3/updates/SRPMS/gaim-1.5.0-0.73.1.legacy.src.rpm

99901a3c55dc899071cd0373c71ce18b694e38d0
redhat/9/updates/i386/gaim-1.5.0-0.90.1.legacy.i386.rpm
47f2231f0085bfd8c24e3a01ae707781543bb243
redhat/9/updates/SRPMS/gaim-1.5.0-0.90.1.legacy.src.rpm

fda20f97bf8c2ce8a5075c579bcbf6c3e3a66e81
fedora/1/updates/i386/gaim-1.5.0-1.fc1.1.legacy.i386.rpm
8be725ea3874e315278e4926ed72930c74a3d6df
fedora/1/updates/SRPMS/gaim-1.5.0-1.fc1.1.legacy.src.rpm

d8c6b98a019633a8a2debd6e2a86daccae6cdeda
fedora/2/updates/i386/gaim-1.5.0-1.fc2.1.legacy.i386.rpm
46e6ff8101c40018ab98b7f3c5e01f656eb2cdfe
fedora/2/updates/SRPMS/gaim-1.5.0-1.fc2.1.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security.  Our key is
available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

    sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0208
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0473
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0472
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0965
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0966
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0967
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1261
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1262
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2103
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2102
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2370
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1269
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1934

9. Contact:

The Fedora Legacy security contact is <secnotice@...oralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------

Download attachment "signature.asc" of type "application/pgp-signature" (192 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists