Red Hat Product Errata RHSA-2005:365 - Security Advisory
Issued:
2005-04-12
Updated:
2005-04-12

RHSA-2005:365 - Security Advisory

Synopsis

gaim security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An updated gaim package that fixes multiple denial of service issues is now
available.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The Gaim application is a multi-protocol instant messaging client.

A buffer overflow bug was found in the way gaim escapes HTML. It is
possible that a remote attacker could send a specially crafted message to a
Gaim client, causing it to crash. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2005-0965 to this issue.

A bug was found in several of gaim's IRC processing functions. These
functions fail to properly remove various markup tags within an IRC
message. It is possible that a remote attacker could send a specially
crafted message to a Gaim client connected to an IRC server, causing it to
crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0966 to this issue.

A bug was found in gaim's Jabber message parser. It is possible for a
remote Jabber user to send a specially crafted message to a Gaim client,
causing it to crash. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-0967 to this issue.

In addition to these denial of service issues, multiple minor upstream
bugfixes are included in this update.

Users of Gaim are advised to upgrade to this updated package which contains
Gaim version 1.2.1 and is not vulnerable to these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

Red Hat Enterprise Linux Server 4

SRPM
gaim-1.2.1-4.el4.src.rpm SHA-256: 66ad30ae580174f1239a7c57c81c88560f8053e5ec440ab739139753997c0e1b
x86_64
gaim-1.2.1-4.el4.x86_64.rpm SHA-256: bcbef1724927ea71f11515875ccd8056ed1563bbb194bfe0baba754ffedfdd07
gaim-1.2.1-4.el4.x86_64.rpm SHA-256: bcbef1724927ea71f11515875ccd8056ed1563bbb194bfe0baba754ffedfdd07
ia64
gaim-1.2.1-4.el4.ia64.rpm SHA-256: 94790eaceed4c5a5641597bb4cd0c36ad68040f4278a22493043e3b48758e7c5
gaim-1.2.1-4.el4.ia64.rpm SHA-256: 94790eaceed4c5a5641597bb4cd0c36ad68040f4278a22493043e3b48758e7c5
i386
gaim-1.2.1-4.el4.i386.rpm SHA-256: 481d40c96d01983113dbd71221548b48f3534eb44c391d102516fc42faf71120
gaim-1.2.1-4.el4.i386.rpm SHA-256: 481d40c96d01983113dbd71221548b48f3534eb44c391d102516fc42faf71120

Red Hat Enterprise Linux Server 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Workstation 4

SRPM
gaim-1.2.1-4.el4.src.rpm SHA-256: 66ad30ae580174f1239a7c57c81c88560f8053e5ec440ab739139753997c0e1b
x86_64
gaim-1.2.1-4.el4.x86_64.rpm SHA-256: bcbef1724927ea71f11515875ccd8056ed1563bbb194bfe0baba754ffedfdd07
ia64
gaim-1.2.1-4.el4.ia64.rpm SHA-256: 94790eaceed4c5a5641597bb4cd0c36ad68040f4278a22493043e3b48758e7c5
i386
gaim-1.2.1-4.el4.i386.rpm SHA-256: 481d40c96d01983113dbd71221548b48f3534eb44c391d102516fc42faf71120

Red Hat Enterprise Linux Workstation 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Desktop 4

SRPM
gaim-1.2.1-4.el4.src.rpm SHA-256: 66ad30ae580174f1239a7c57c81c88560f8053e5ec440ab739139753997c0e1b
x86_64
gaim-1.2.1-4.el4.x86_64.rpm SHA-256: bcbef1724927ea71f11515875ccd8056ed1563bbb194bfe0baba754ffedfdd07
i386
gaim-1.2.1-4.el4.i386.rpm SHA-256: 481d40c96d01983113dbd71221548b48f3534eb44c391d102516fc42faf71120

Red Hat Enterprise Linux Desktop 3

SRPM
x86_64
i386

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
gaim-1.2.1-4.el4.src.rpm SHA-256: 66ad30ae580174f1239a7c57c81c88560f8053e5ec440ab739139753997c0e1b
s390x
gaim-1.2.1-4.el4.s390x.rpm SHA-256: aa69a1cbbddf6cb6b4867be4fc4faea39343ff63ff126c667cea6e5ab36ffe7a
s390
gaim-1.2.1-4.el4.s390.rpm SHA-256: 878062ec00f86629f6c7ea24b83893aee78006365eb434bc8a4c23e949ec2b0c

Red Hat Enterprise Linux for IBM z Systems 3

SRPM
s390x
s390

Red Hat Enterprise Linux for Power, big endian 4

SRPM
gaim-1.2.1-4.el4.src.rpm SHA-256: 66ad30ae580174f1239a7c57c81c88560f8053e5ec440ab739139753997c0e1b
ppc
gaim-1.2.1-4.el4.ppc.rpm SHA-256: fe3e247f3b21fa5d993ee51e2f0503d393158986bdf03eb921e7049073694e4e

Red Hat Enterprise Linux for Power, big endian 3

SRPM
ppc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.