Synopsis

gaim security update

Type/Severity

Security Advisory: Critical

Topic

An updated gaim package that fixes two security issues is now available.

This update has been rated as having critical security impact by the Red Hat
Security Response Team.

Description

The Gaim application is a multi-protocol instant messaging client.

A stack based buffer overflow bug was found in the way gaim processes a
message containing a URL. A remote attacker could send a carefully crafted
message resulting in the execution of arbitrary code on a victim's machine.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-1261 to this issue.

A bug was found in the way gaim handles malformed MSN messages. A remote
attacker could send a carefully crafted MSN message causing gaim to crash.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-1262 to this issue.

Users of Gaim are advised to upgrade to this updated package which contains
backported patches and is not vulnerable to these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 157017 - CAN-2005-1261 Gaim long url buffer overflow
• BZ - 157202 - CAN-2005-1262 Gaim MSN DoS

CVEs

• CVE-2005-1261
• CVE-2005-1262

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
gaim-1.2.1-6.el4.src.rpm	SHA-256: 2c447f9ec8af6d5082b5a96ed8cc247030dcb57b1f3ae1314403854896d4fd13
x86_64
gaim-1.2.1-6.el4.x86_64.rpm	SHA-256: 5abc40e353c026b1bfa237e044f4b282f5e2f448b8c05e6d414583118e4a4016
gaim-1.2.1-6.el4.x86_64.rpm	SHA-256: 5abc40e353c026b1bfa237e044f4b282f5e2f448b8c05e6d414583118e4a4016
ia64
gaim-1.2.1-6.el4.ia64.rpm	SHA-256: 05e6e45bd2981b576820afe074ed2685b00e21e3e2c5998fda8089ece0c6dd47
gaim-1.2.1-6.el4.ia64.rpm	SHA-256: 05e6e45bd2981b576820afe074ed2685b00e21e3e2c5998fda8089ece0c6dd47
i386
gaim-1.2.1-6.el4.i386.rpm	SHA-256: d6b8fdf7f22e023664afaa348303c5dd0c1bb14ce191c546bd94077abf67cfb8
gaim-1.2.1-6.el4.i386.rpm	SHA-256: d6b8fdf7f22e023664afaa348303c5dd0c1bb14ce191c546bd94077abf67cfb8

Red Hat Enterprise Linux Workstation 4

SRPM
gaim-1.2.1-6.el4.src.rpm	SHA-256: 2c447f9ec8af6d5082b5a96ed8cc247030dcb57b1f3ae1314403854896d4fd13
x86_64
gaim-1.2.1-6.el4.x86_64.rpm	SHA-256: 5abc40e353c026b1bfa237e044f4b282f5e2f448b8c05e6d414583118e4a4016
ia64
gaim-1.2.1-6.el4.ia64.rpm	SHA-256: 05e6e45bd2981b576820afe074ed2685b00e21e3e2c5998fda8089ece0c6dd47
i386
gaim-1.2.1-6.el4.i386.rpm	SHA-256: d6b8fdf7f22e023664afaa348303c5dd0c1bb14ce191c546bd94077abf67cfb8

Red Hat Enterprise Linux Desktop 4

SRPM
gaim-1.2.1-6.el4.src.rpm	SHA-256: 2c447f9ec8af6d5082b5a96ed8cc247030dcb57b1f3ae1314403854896d4fd13
x86_64
gaim-1.2.1-6.el4.x86_64.rpm	SHA-256: 5abc40e353c026b1bfa237e044f4b282f5e2f448b8c05e6d414583118e4a4016
i386
gaim-1.2.1-6.el4.i386.rpm	SHA-256: d6b8fdf7f22e023664afaa348303c5dd0c1bb14ce191c546bd94077abf67cfb8

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
gaim-1.2.1-6.el4.src.rpm	SHA-256: 2c447f9ec8af6d5082b5a96ed8cc247030dcb57b1f3ae1314403854896d4fd13
s390x
gaim-1.2.1-6.el4.s390x.rpm	SHA-256: 55da97c30faeebca40261b44f87a52c65dc9166c62c7ff094f63c0481264b484
s390
gaim-1.2.1-6.el4.s390.rpm	SHA-256: 969552b4a10bc6be1a62ed0a8d09c7ba89055e9fe1481bd7979193bd3ea048e8

Red Hat Enterprise Linux for Power, big endian 4

SRPM
gaim-1.2.1-6.el4.src.rpm	SHA-256: 2c447f9ec8af6d5082b5a96ed8cc247030dcb57b1f3ae1314403854896d4fd13
ppc
gaim-1.2.1-6.el4.ppc.rpm	SHA-256: c16d74bc62ae8d4e011a7d3a0215c43f27f80e75fe3f86c05707830e6b0c7b64