-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Fedora Legacy Update Advisory Synopsis: Updated gaim package fixes security issues Advisory ID: FLSA:158543 Issue date: 2006-02-24 Products: Red Hat Linux, Fedora Core Keywords: Bugfix CVE Names: CAN-2005-0208 CAN-2005-0473 CAN-2005-0472 CAN-2005-0965 CAN-2005-0966 CAN-2005-0967 CAN-2005-1261 CAN-2005-1262 CAN-2005-2103 CAN-2005-2102 CAN-2005-2370 CAN-2005-1269 CAN-2005-1934 - --------------------------------------------------------------------- - --------------------------------------------------------------------- 1. Topic: An updated gaim package that fixes various security issues as well as a number of bugs is now available. The Gaim application is a multi-protocol instant messaging client. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 Fedora Core 2 - i386 3. Problem description: Two HTML parsing bugs were discovered in Gaim. It is possible that a remote attacker could send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2005-0208 and CAN-2005-0473 to these issues. A bug in the way Gaim processes SNAC packets was discovered. It is possible that a remote attacker could send a specially crafted SNAC packet to a Gaim client, causing the client to stop responding. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0472 to this issue. A buffer overflow bug was found in the way gaim escapes HTML. It is possible that a remote attacker could send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0965 to this issue. A bug was found in several of gaim's IRC processing functions. These functions fail to properly remove various markup tags within an IRC message. It is possible that a remote attacker could send a specially crafted message to a Gaim client connected to an IRC server, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0966 to this issue. A bug was found in gaim's Jabber message parser. It is possible for a remote Jabber user to send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0967 to this issue. A stack based buffer overflow bug was found in the way gaim processes a message containing a URL. A remote attacker could send a carefully crafted message resulting in the execution of arbitrary code on a victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1261 to this issue. A bug was found in the way gaim handles malformed MSN messages. A remote attacker could send a carefully crafted MSN message causing gaim to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1262 to this issue. A heap based buffer overflow issue was discovered in the way Gaim processes away messages. A remote attacker could send a specially crafted away message to a Gaim user logged into AIM or ICQ that could result in arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2103 to this issue. Daniel Atallah discovered a denial of service issue in Gaim. A remote attacker could attempt to upload a file with a specially crafted name to a user logged into AIM or ICQ, causing Gaim to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2102 to this issue. A denial of service bug was found in Gaim's Gadu Gadu protocol handler. A remote attacker could send a specially crafted message to a Gaim user logged into Gadu Gadu, causing Gaim to crash. Please note that this issue only affects PPC and IBM S/390 systems running Gaim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2370 to this issue. Jacopo Ottaviani discovered a bug in the way Gaim handles Yahoo! Messenger file transfers. It is possible for a malicious user to send a specially crafted file transfer request that causes Gaim to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1269 to this issue. Additionally, Hugo de Bokkenrijder discovered a bug in the way Gaim parses MSN Messenger messages. It is possible for a malicious user to send a specially crafted MSN Messenger message that causes Gaim to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1934 to this issue. Additionally, various client crashes, memory leaks, and protocol issues have been resolved. Users of Gaim are advised to upgrade to this updated package which contains Gaim version 1.5.0 and is not vulnerable to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=158543 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gaim-1.5.0-0.73.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/gaim-1.5.0-0.73.1.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gaim-1.5.0-0.90.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/gaim-1.5.0-0.90.1.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/gaim-1.5.0-1.fc1.1.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/gaim-1.5.0-1.fc1.1.legacy.i386.rpm Fedora Core 2: SRPM: http://download.fedoralegacy.org/fedora/2/updates/SRPMS/gaim-1.5.0-1.fc2.1.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/2/updates/i386/gaim-1.5.0-1.fc2.1.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - --------------------------------------------------------------------- a51c47a7e69e2ae0de301b5aea04a078a34bd494 redhat/7.3/updates/i386/gaim-1.5.0-0.73.1.legacy.i386.rpm cf664d6dea2391a620286c2a0558f344128dc09b redhat/7.3/updates/SRPMS/gaim-1.5.0-0.73.1.legacy.src.rpm 99901a3c55dc899071cd0373c71ce18b694e38d0 redhat/9/updates/i386/gaim-1.5.0-0.90.1.legacy.i386.rpm 47f2231f0085bfd8c24e3a01ae707781543bb243 redhat/9/updates/SRPMS/gaim-1.5.0-0.90.1.legacy.src.rpm fda20f97bf8c2ce8a5075c579bcbf6c3e3a66e81 fedora/1/updates/i386/gaim-1.5.0-1.fc1.1.legacy.i386.rpm 8be725ea3874e315278e4926ed72930c74a3d6df fedora/1/updates/SRPMS/gaim-1.5.0-1.fc1.1.legacy.src.rpm d8c6b98a019633a8a2debd6e2a86daccae6cdeda fedora/2/updates/i386/gaim-1.5.0-1.fc2.1.legacy.i386.rpm 46e6ff8101c40018ab98b7f3c5e01f656eb2cdfe fedora/2/updates/SRPMS/gaim-1.5.0-1.fc2.1.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0208 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0473 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0472 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0965 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0966 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0967 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1261 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1262 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2102 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2370 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1269 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1934 9. Contact: The Fedora Legacy security contact is . More project details at http://www.fedoralegacy.org - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQFD/sn5xou1V/j9XZwRAtojAKCV+P71FT3K/LAvHcg1xDOx+pTlEQCg1dVV lfimf+WLK/MixZuJD47RI8c= =6FpQ -----END PGP SIGNATURE-----