Vulnerabilities > CVE-2004-0007 - Remote Boundary Condition Error vulnerability in Gaim

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
rob-flynn
ultramagnetic
nessus

Summary

Buffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Vulnerable Configurations

Part Description Count
Application
Rob_Flynn
1
Application
Ultramagnetic
1

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-434.NASL
    descriptionStefan Esser discovered several security related problems in Gaim, a multi-protocol instant messaging client. Not all of them are applicable for the version in Debian stable, but affected the version in the unstable distribution at least. The problems were grouped for the Common Vulnerabilities and Exposures as follows : - CAN-2004-0005 When the Yahoo Messenger handler decodes an octal value for email notification functions two different kinds of overflows can be triggered. When the MIME decoder decoded a quoted printable encoded string for email notification two other different kinds of overflows can be triggered. These problems only affect the version in the unstable distribution. - CAN-2004-0006 When parsing the cookies within the HTTP reply header of a Yahoo web connection a buffer overflow can happen. When parsing the Yahoo Login Webpage the YMSG protocol overflows stack buffers if the web page returns oversized values. When splitting a URL into its parts a stack overflow can be caused. These problems only affect the version in the unstable distribution. When an oversized keyname is read from a Yahoo Messenger packet a stack overflow can be triggered. When Gaim is setup to use an HTTP proxy for connecting to the server a malicious HTTP proxy can exploit it. These problems affect all versions Debian ships. However, the connection to Yahoo doesn
    last seen2020-06-01
    modified2020-06-02
    plugin id15271
    published2004-09-29
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15271
    titleDebian DSA-434-1 : gaim - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-434. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(15271);
      script_version("1.22");
      script_cvs_date("Date: 2019/08/02 13:32:17");
    
      script_cve_id("CVE-2004-0005", "CVE-2004-0006", "CVE-2004-0007", "CVE-2004-0008");
      script_bugtraq_id(9489);
      script_xref(name:"DSA", value:"434");
    
      script_name(english:"Debian DSA-434-1 : gaim - several vulnerabilities");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Stefan Esser discovered several security related problems in Gaim, a
    multi-protocol instant messaging client. Not all of them are
    applicable for the version in Debian stable, but affected the version
    in the unstable distribution at least. The problems were grouped for
    the Common Vulnerabilities and Exposures as follows :
    
      - CAN-2004-0005
        When the Yahoo Messenger handler decodes an octal value
        for email notification functions two different kinds of
        overflows can be triggered. When the MIME decoder
        decoded a quoted printable encoded string for email
        notification two other different kinds of overflows can
        be triggered. These problems only affect the version in
        the unstable distribution.
    
      - CAN-2004-0006
    
        When parsing the cookies within the HTTP reply header of
        a Yahoo web connection a buffer overflow can happen.
        When parsing the Yahoo Login Webpage the YMSG protocol
        overflows stack buffers if the web page returns
        oversized values. When splitting a URL into its parts a
        stack overflow can be caused. These problems only affect
        the version in the unstable distribution.
    
      When an oversized keyname is read from a Yahoo Messenger packet a
      stack overflow can be triggered. When Gaim is setup to use an HTTP
      proxy for connecting to the server a malicious HTTP proxy can
      exploit it. These problems affect all versions Debian ships.
      However, the connection to Yahoo doesn't work in the version in
      Debian stable.
    
      - CAN-2004-0007
    
        Internally data is copied between two tokens into a
        fixed size stack buffer without a size check. This only
        affects the version of gaim in the unstable
        distribution.
    
      - CAN-2004-0008
    
        When allocating memory for AIM/Oscar DirectIM packets an
        integer overflow can happen, resulting in a heap
        overflow. This only affects the version of gaim in the
        unstable distribution."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.debian.org/security/2004/dsa-434"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the gaim packages.
    
    For the stable distribution (woody) these problems has been fixed in
    version 0.58-2.4."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gaim");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/02/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/29");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"3.0", prefix:"gaim", reference:"0.58-2.4")) flag++;
    if (deb_check(release:"3.0", prefix:"gaim-common", reference:"0.58-2.4")) flag++;
    if (deb_check(release:"3.0", prefix:"gaim-gnome", reference:"0.58-2.4")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2004-006.NASL
    descriptionA number of vulnerabilities were discovered in the gaim instant messenger program by Steffan Esser, versions 0.75 and earlier. Thanks to Jacques A. Vidrine for providing initial patches. Multiple buffer overflows exist in gaim 0.75 and earlier: When parsing cookies in a Yahoo web connection; YMSG protocol overflows parsing the Yahoo login webpage; a YMSG packet overflow; flaws in the URL parser; and flaws in the HTTP Proxy connect (CAN-2004-006). A buffer overflow in gaim 0.74 and earlier in the Extract Info Field Function used for MSN and YMSG protocol handlers (CAN-2004-007). An integer overflow in gaim 0.74 and earlier, when allocating memory for a directIM packet results in a heap overflow (CVE-2004-0008). Update : The patch used to correct the problem was slightly malformed and could cause an infinite loop and crash with the Yahoo protocol. The new packages have a corrected patch that resolves the problem.
    last seen2020-06-01
    modified2020-06-02
    plugin id14106
    published2004-07-31
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/14106
    titleMandrake Linux Security Advisory : gaim (MDKSA-2004:006-1)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2004:006. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(14106);
      script_version ("1.19");
      script_cvs_date("Date: 2019/08/02 13:32:47");
    
      script_cve_id("CVE-2004-0006", "CVE-2004-0007", "CVE-2004-0008");
      script_xref(name:"MDKSA", value:"2004:006-1");
    
      script_name(english:"Mandrake Linux Security Advisory : gaim (MDKSA-2004:006-1)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A number of vulnerabilities were discovered in the gaim instant
    messenger program by Steffan Esser, versions 0.75 and earlier. Thanks
    to Jacques A. Vidrine for providing initial patches.
    
    Multiple buffer overflows exist in gaim 0.75 and earlier: When parsing
    cookies in a Yahoo web connection; YMSG protocol overflows parsing the
    Yahoo login webpage; a YMSG packet overflow; flaws in the URL parser;
    and flaws in the HTTP Proxy connect (CAN-2004-006).
    
    A buffer overflow in gaim 0.74 and earlier in the Extract Info Field
    Function used for MSN and YMSG protocol handlers (CAN-2004-007).
    
    An integer overflow in gaim 0.74 and earlier, when allocating memory
    for a directIM packet results in a heap overflow (CVE-2004-0008).
    
    Update :
    
    The patch used to correct the problem was slightly malformed and could
    cause an infinite loop and crash with the Yahoo protocol. The new
    packages have a corrected patch that resolves the problem."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:gaim");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:gaim-encrypt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:gaim-festival");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:gaim-perl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gaim-remote0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gaim-remote0-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgaim-remote0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgaim-remote0-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:9.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:9.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/01/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/31");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"gaim-0.75-1.2.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"gaim-encrypt-0.75-1.2.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libgaim-remote0-0.75-1.2.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libgaim-remote0-devel-0.75-1.2.91mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK9.2", reference:"gaim-0.75-1.2.92mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.2", reference:"gaim-encrypt-0.75-1.2.92mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.2", reference:"gaim-festival-0.75-1.2.92mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.2", reference:"gaim-perl-0.75-1.2.92mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gaim-remote0-0.75-1.2.92mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gaim-remote0-devel-0.75-1.2.92mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgaim-remote0-0.75-1.2.92mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgaim-remote0-devel-0.75-1.2.92mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_GAIM_076.NASL
    descriptionThe following package needs to be updated: gaim
    last seen2016-09-26
    modified2004-07-06
    plugin id12543
    published2004-07-06
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=12543
    titleFreeBSD : Several remotely exploitable buffer overflows in gaim (52)
    code
    #%NASL_MIN_LEVEL 999999
    
    # @DEPRECATED@
    #
    # This script has been deprecated by freebsd_pkg_6fd024395d7011d880e30020ed76ef5a.nasl.
    #
    # Disabled on 2011/10/02.
    #
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # This script contains information extracted from VuXML :
    #
    # Copyright 2003-2006 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #   copyright notice, this list of conditions and the following
    #   disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #   published online in any format, converted to PDF, PostScript,
    #   RTF and other formats) must reproduce the above copyright
    #   notice, this list of conditions and the following disclaimer
    #   in the documentation and/or other materials provided with the
    #   distribution.
    #
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    #
    #
    
    include('compat.inc');
    
    if ( description )
    {
     script_id(12543);
     script_version("1.10");
     script_cve_id("CVE-2004-0008");
     script_cve_id("CVE-2004-0007");
     script_cve_id("CVE-2004-0006");
     script_cve_id("CVE-2004-0005");
    
     script_name(english:"FreeBSD : Several remotely exploitable buffer overflows in gaim (52)");
    
    script_set_attribute(attribute:'synopsis', value: 'The remote host is missing a security update');
    script_set_attribute(attribute:'description', value:'The following package needs to be updated: gaim');
    script_set_attribute(attribute: 'cvss_vector', value: 'CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P');
    script_set_attribute(attribute:'solution', value: 'Update the package on the remote host');
    script_set_attribute(attribute: 'see_also', value: 'http://bugs.libgd.org/?do=details&task_id=70
    http://bugs.libgd.org/?do=details&task_id=87
    http://bugs.libgd.org/?do=details&task_id=89
    http://bugs.libgd.org/?do=details&task_id=94
    http://secunia.com/advisories/11804
    http://security.e-matters.de/advisories/012004.txt
    http://www.frsirt.com/english/advisories/2007/2336
    http://www.idefense.com/application/poi/display?id=107&type=vulnerabilities&flashstatus=false
    http://www.libgd.org/ReleaseNote020035
    http://www.mozilla.org/projects/security/known-vulnerabilities.html
    http://www.mozilla.org/security/announce/mfsa2005-46.html
    http://www.mozilla.org/security/announce/mfsa2005-47.html');
    script_set_attribute(attribute:'see_also', value: 'http://www.FreeBSD.org/ports/portaudit/6fd02439-5d70-11d8-80e3-0020ed76ef5a.html');
    
     script_set_attribute(attribute:"plugin_publication_date", value: "2004/07/06");
     script_end_attributes();
     script_summary(english:"Check for gaim");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
     family["english"] = "FreeBSD Local Security Checks";
     script_family(english:family["english"]);
     script_dependencies("ssh_get_info.nasl");
     script_require_keys("Host/FreeBSD/pkg_info");
     exit(0);
    }
    
    # Deprecated.
    exit(0, "This plugin has been deprecated. Refer to plugin #37025 (freebsd_pkg_6fd024395d7011d880e30020ed76ef5a.nasl) instead.");
    
    global_var cvss_score;
    cvss_score=7;
    include('freebsd_package.inc');
    
    
    pkg_test(pkg:"gaim<0.75_3");
    
    pkg_test(pkg:"gaim=0.75_5");
    
    pkg_test(pkg:"gaim=0.76");
    
    pkg_test(pkg:"ja-gaim<0.75_3");
    
    pkg_test(pkg:"ja-gaim=0.75_5");
    
    pkg_test(pkg:"ja-gaim=0.76");
    
    pkg_test(pkg:"ko-gaim<0.75_3");
    
    pkg_test(pkg:"ko-gaim=0.75_5");
    
    pkg_test(pkg:"ko-gaim=0.76");
    
    pkg_test(pkg:"ru-gaim<0.75_3");
    
    pkg_test(pkg:"ru-gaim=0.75_5");
    
    pkg_test(pkg:"ru-gaim=0.76");
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_6FD024395D7011D880E30020ED76EF5A.NASL
    descriptionStefan Esser of e-matters found almost a dozen remotely exploitable vulnerabilities in Gaim. From the e-matters advisory : While developing a custom add-on, an integer overflow in the handling of AIM DirectIM packets was revealed that could lead to a remote compromise of the IM client. After disclosing this bug to the vendor, they had to make a hurried release because of a change in the Yahoo connection procedure that rendered GAIM useless. Unfourtunately at the same time a closer look onto the sourcecode revealed 11 more vulnerabilities. The 12 identified problems range from simple standard stack overflows, over heap overflows to an integer overflow that can be abused to cause a heap overflow. Due to the nature of instant messaging many of these bugs require man-in-the-middle attacks between client and server. But the underlying protocols are easy to implement and MIM attacks on ordinary TCP sessions is a fairly simple task. In combination with the latest kernel vulnerabilities or the habit of users to work as root/administrator these bugs can result in remote root compromises.
    last seen2020-06-01
    modified2020-06-02
    plugin id37025
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/37025
    titleFreeBSD : Several remotely exploitable buffer overflows in gaim (6fd02439-5d70-11d8-80e3-0020ed76ef5a)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(37025);
      script_version("1.12");
      script_cvs_date("Date: 2019/08/02 13:32:36");
    
      script_cve_id("CVE-2004-0005", "CVE-2004-0006", "CVE-2004-0007", "CVE-2004-0008");
    
      script_name(english:"FreeBSD : Several remotely exploitable buffer overflows in gaim (6fd02439-5d70-11d8-80e3-0020ed76ef5a)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Stefan Esser of e-matters found almost a dozen remotely exploitable
    vulnerabilities in Gaim. From the e-matters advisory :
    
    While developing a custom add-on, an integer overflow in the handling
    of AIM DirectIM packets was revealed that could lead to a remote
    compromise of the IM client. After disclosing this bug to the vendor,
    they had to make a hurried release because of a change in the Yahoo
    connection procedure that rendered GAIM useless. Unfourtunately at the
    same time a closer look onto the sourcecode revealed 11 more
    vulnerabilities.
    
    The 12 identified problems range from simple standard stack overflows,
    over heap overflows to an integer overflow that can be abused to cause
    a heap overflow. Due to the nature of instant messaging many of these
    bugs require man-in-the-middle attacks between client and server. But
    the underlying protocols are easy to implement and MIM attacks on
    ordinary TCP sessions is a fairly simple task.
    
    In combination with the latest kernel vulnerabilities or the habit of
    users to work as root/administrator these bugs can result in remote
    root compromises."
      );
      # http://security.e-matters.de/advisories/012004.txt
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?fdb6dd3c"
      );
      # https://vuxml.freebsd.org/freebsd/6fd02439-5d70-11d8-80e3-0020ed76ef5a.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?91332096"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:gaim");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:gaim");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ja-gaim");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ko-gaim");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ru-gaim");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/01/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2004/02/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"gaim<0.75_3")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"gaim=0.75_5")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"gaim=0.76")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ja-gaim<0.75_3")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ja-gaim=0.75_5")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ja-gaim=0.76")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ko-gaim<0.75_3")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ko-gaim=0.75_5")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ko-gaim=0.76")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ru-gaim<0.75_3")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ru-gaim=0.75_5")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ru-gaim=0.76")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"gaim>=20030000")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2004-033.NASL
    descriptionUpdated Gaim packages that fix a number of serious vulnerabilities are now available. Gaim is an instant messenger client that can handle multiple protocols. Stefan Esser audited the Gaim source code and found a number of bugs that have security implications. Due to the nature of instant messaging many of these bugs require man-in-the-middle attacks between client and server. However at least one of the buffer overflows could be exploited by an attacker sending a carefully-constructed malicious message through a server. The issues include : Multiple buffer overflows that affect versions of Gaim 0.75 and earlier. 1) When parsing cookies in a Yahoo web connection, 2) YMSG protocol overflows parsing the Yahoo login webpage, 3) a YMSG packet overflow, 4) flaws in the URL parser, and 5) flaws in HTTP Proxy connect. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0006 to these issues. A buffer overflow in Gaim 0.74 and earlier in the Extract Info Field Function used for MSN and YMSG protocol handlers. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0007 to this issue. An integer overflow in Gaim 0.74 and earlier, when allocating memory for a directIM packet results in heap overflow. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0008 to this issue. All users of Gaim should upgrade to these erratum packages, which contain backported security patches correcting these issues. Red Hat would like to thank Steffan Esser for finding and reporting these issues and Jacques A. Vidrine for providing initial patches.
    last seen2020-06-01
    modified2020-06-02
    plugin id12455
    published2004-07-06
    reporterThis script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/12455
    titleRHEL 3 : gaim (RHSA-2004:033)

Oval

  • accepted2007-04-25T19:52:55.739-04:00
    classvulnerability
    contributors
    • nameJay Beale
      organizationBastille Linux
    • nameThomas R. Jones
      organizationMaitreya Security
    descriptionBuffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
    familyunix
    idoval:org.mitre.oval:def:819
    statusaccepted
    submitted2004-03-20T12:00:00.000-04:00
    titleGaim / Ultramagnetic Extract Info Field Function BO
    version38
  • accepted2013-04-29T04:23:14.171-04:00
    classvulnerability
    contributors
    • nameAharon Chernin
      organizationSCAP.com, LLC
    • nameDragos Prisaca
      organizationG2, Inc.
    definition_extensions
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
      ovaloval:org.mitre.oval:def:11782
    • commentCentOS Linux 3.x
      ovaloval:org.mitre.oval:def:16651
    descriptionBuffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
    familyunix
    idoval:org.mitre.oval:def:9906
    statusaccepted
    submitted2010-07-09T03:56:16-04:00
    titleBuffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
    version26

Redhat

advisories
  • rhsa
    idRHSA-2004:032
  • rhsa
    idRHSA-2004:033