Vulnerabilities > CVE-2004-0005 - Off-by-one Error vulnerability in Gaim Project Gaim 0.75

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-434. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(15271);
  script_version("1.22");
  script_cvs_date("Date: 2019/08/02 13:32:17");

  script_cve_id("CVE-2004-0005", "CVE-2004-0006", "CVE-2004-0007", "CVE-2004-0008");
  script_bugtraq_id(9489);
  script_xref(name:"DSA", value:"434");

  script_name(english:"Debian DSA-434-1 : gaim - several vulnerabilities");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Stefan Esser discovered several security related problems in Gaim, a
multi-protocol instant messaging client. Not all of them are
applicable for the version in Debian stable, but affected the version
in the unstable distribution at least. The problems were grouped for
the Common Vulnerabilities and Exposures as follows :

  - CAN-2004-0005
    When the Yahoo Messenger handler decodes an octal value
    for email notification functions two different kinds of
    overflows can be triggered. When the MIME decoder
    decoded a quoted printable encoded string for email
    notification two other different kinds of overflows can
    be triggered. These problems only affect the version in
    the unstable distribution.

  - CAN-2004-0006

    When parsing the cookies within the HTTP reply header of
    a Yahoo web connection a buffer overflow can happen.
    When parsing the Yahoo Login Webpage the YMSG protocol
    overflows stack buffers if the web page returns
    oversized values. When splitting a URL into its parts a
    stack overflow can be caused. These problems only affect
    the version in the unstable distribution.

  When an oversized keyname is read from a Yahoo Messenger packet a
  stack overflow can be triggered. When Gaim is setup to use an HTTP
  proxy for connecting to the server a malicious HTTP proxy can
  exploit it. These problems affect all versions Debian ships.
  However, the connection to Yahoo doesn't work in the version in
  Debian stable.

  - CAN-2004-0007

    Internally data is copied between two tokens into a
    fixed size stack buffer without a size check. This only
    affects the version of gaim in the unstable
    distribution.

  - CAN-2004-0008

    When allocating memory for AIM/Oscar DirectIM packets an
    integer overflow can happen, resulting in a heap
    overflow. This only affects the version of gaim in the
    unstable distribution."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.debian.org/security/2004/dsa-434"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the gaim packages.

For the stable distribution (woody) these problems has been fixed in
version 0.58-2.4."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gaim");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2004/02/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"3.0", prefix:"gaim", reference:"0.58-2.4")) flag++;
if (deb_check(release:"3.0", prefix:"gaim-common", reference:"0.58-2.4")) flag++;
if (deb_check(release:"3.0", prefix:"gaim-gnome", reference:"0.58-2.4")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 999999

# @DEPRECATED@
#
# This script has been deprecated by freebsd_pkg_6fd024395d7011d880e30020ed76ef5a.nasl.
#
# Disabled on 2011/10/02.
#

#
# (C) Tenable Network Security, Inc.
#
# This script contains information extracted from VuXML :
#
# Copyright 2003-2006 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#   copyright notice, this list of conditions and the following
#   disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#   published online in any format, converted to PDF, PostScript,
#   RTF and other formats) must reproduce the above copyright
#   notice, this list of conditions and the following disclaimer
#   in the documentation and/or other materials provided with the
#   distribution.
#
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
#

include('compat.inc');

if ( description )
{
 script_id(12543);
 script_version("1.10");
 script_cve_id("CVE-2004-0008");
 script_cve_id("CVE-2004-0007");
 script_cve_id("CVE-2004-0006");
 script_cve_id("CVE-2004-0005");

 script_name(english:"FreeBSD : Several remotely exploitable buffer overflows in gaim (52)");

script_set_attribute(attribute:'synopsis', value: 'The remote host is missing a security update');
script_set_attribute(attribute:'description', value:'The following package needs to be updated: gaim');
script_set_attribute(attribute: 'cvss_vector', value: 'CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P');
script_set_attribute(attribute:'solution', value: 'Update the package on the remote host');
script_set_attribute(attribute: 'see_also', value: 'http://bugs.libgd.org/?do=details&task_id=70
http://bugs.libgd.org/?do=details&task_id=87
http://bugs.libgd.org/?do=details&task_id=89
http://bugs.libgd.org/?do=details&task_id=94
http://secunia.com/advisories/11804
http://security.e-matters.de/advisories/012004.txt
http://www.frsirt.com/english/advisories/2007/2336
http://www.idefense.com/application/poi/display?id=107&type=vulnerabilities&flashstatus=false
http://www.libgd.org/ReleaseNote020035
http://www.mozilla.org/projects/security/known-vulnerabilities.html
http://www.mozilla.org/security/announce/mfsa2005-46.html
http://www.mozilla.org/security/announce/mfsa2005-47.html');
script_set_attribute(attribute:'see_also', value: 'http://www.FreeBSD.org/ports/portaudit/6fd02439-5d70-11d8-80e3-0020ed76ef5a.html');

 script_set_attribute(attribute:"plugin_publication_date", value: "2004/07/06");
 script_end_attributes();
 script_summary(english:"Check for gaim");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
 family["english"] = "FreeBSD Local Security Checks";
 script_family(english:family["english"]);
 script_dependencies("ssh_get_info.nasl");
 script_require_keys("Host/FreeBSD/pkg_info");
 exit(0);
}

# Deprecated.
exit(0, "This plugin has been deprecated. Refer to plugin #37025 (freebsd_pkg_6fd024395d7011d880e30020ed76ef5a.nasl) instead.");

global_var cvss_score;
cvss_score=7;
include('freebsd_package.inc');


pkg_test(pkg:"gaim<0.75_3");

pkg_test(pkg:"gaim=0.75_5");

pkg_test(pkg:"gaim=0.76");

pkg_test(pkg:"ja-gaim<0.75_3");

pkg_test(pkg:"ja-gaim=0.75_5");

pkg_test(pkg:"ja-gaim=0.76");

pkg_test(pkg:"ko-gaim<0.75_3");

pkg_test(pkg:"ko-gaim=0.75_5");

pkg_test(pkg:"ko-gaim=0.76");

pkg_test(pkg:"ru-gaim<0.75_3");

pkg_test(pkg:"ru-gaim=0.75_5");

pkg_test(pkg:"ru-gaim=0.76");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2018 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(37025);
  script_version("1.12");
  script_cvs_date("Date: 2019/08/02 13:32:36");

  script_cve_id("CVE-2004-0005", "CVE-2004-0006", "CVE-2004-0007", "CVE-2004-0008");

  script_name(english:"FreeBSD : Several remotely exploitable buffer overflows in gaim (6fd02439-5d70-11d8-80e3-0020ed76ef5a)");
  script_summary(english:"Checks for updated packages in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote FreeBSD host is missing one or more security-related
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Stefan Esser of e-matters found almost a dozen remotely exploitable
vulnerabilities in Gaim. From the e-matters advisory :

While developing a custom add-on, an integer overflow in the handling
of AIM DirectIM packets was revealed that could lead to a remote
compromise of the IM client. After disclosing this bug to the vendor,
they had to make a hurried release because of a change in the Yahoo
connection procedure that rendered GAIM useless. Unfourtunately at the
same time a closer look onto the sourcecode revealed 11 more
vulnerabilities.

The 12 identified problems range from simple standard stack overflows,
over heap overflows to an integer overflow that can be abused to cause
a heap overflow. Due to the nature of instant messaging many of these
bugs require man-in-the-middle attacks between client and server. But
the underlying protocols are easy to implement and MIM attacks on
ordinary TCP sessions is a fairly simple task.

In combination with the latest kernel vulnerabilities or the habit of
users to work as root/administrator these bugs can result in remote
root compromises."
  );
  # http://security.e-matters.de/advisories/012004.txt
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?fdb6dd3c"
  );
  # https://vuxml.freebsd.org/freebsd/6fd02439-5d70-11d8-80e3-0020ed76ef5a.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?91332096"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:gaim");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:gaim");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ja-gaim");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ko-gaim");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ru-gaim");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2004/01/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2004/02/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"gaim<0.75_3")) flag++;
if (pkg_test(save_report:TRUE, pkg:"gaim=0.75_5")) flag++;
if (pkg_test(save_report:TRUE, pkg:"gaim=0.76")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ja-gaim<0.75_3")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ja-gaim=0.75_5")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ja-gaim=0.76")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ko-gaim<0.75_3")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ko-gaim=0.75_5")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ko-gaim=0.76")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ru-gaim<0.75_3")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ru-gaim=0.75_5")) flag++;
if (pkg_test(save_report:TRUE, pkg:"ru-gaim=0.76")) flag++;
if (pkg_test(save_report:TRUE, pkg:"gaim>=20030000")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");