Gaim: MSN protocol parsing function buffer overflow — GLSA 200408-12

Gaim contains a remotely exploitable buffer overflow vulnerability in the MSN-protocol parsing code that may allow remote execution of arbitrary code.

Affected packages

Package 	net-im/gaim on all architectures
Affected versions 	<= 0.81
Unaffected versions 	>= 0.81-r1

Background

Gaim is a multi-protocol instant messaging client for Linux which supports many instant messaging protocols.

Description

Sebastian Krahmer of the SuSE Security Team has discovered a remotely exploitable buffer overflow vulnerability in the code handling MSN protocol parsing.

Impact

By sending a carefully-crafted message, an attacker may execute arbitrary code with the permissions of the user running Gaim.

Workaround

There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of Gaim.

Resolution

All Gaim users should upgrade to the latest version:

 # emerge sync
 
 # emerge -pv ">=net-im/gaim-0.81-r1"
 # emerge ">=net-im/gaim-0.81-r1"

References

    OSVDB ID: 8382
    CVE-2004-0500