MDKSA-2004:006 - Updated gaim packages fix multiple vulnerabilities

From: Mandrake Linux Security Team (security_at_linux-mandrake.com)
Date: 01/27/04

  • Next message: lion: "[HUC] Serv-U FTPD 3.x/4.x "SITE CHMOD" Command remote exploit V1.0"
    Date: 27 Jan 2004 00:51:08 -0000
    To: bugtraq@securityfocus.com
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

     _______________________________________________________________________

                    Mandrake Linux Security Update Advisory
     _______________________________________________________________________

     Package name: gaim
     Advisory ID: MDKSA-2004:006
     Date: January 26th, 2004

     Affected versions: 9.1, 9.2
     ______________________________________________________________________

     Problem Description:

     A number of vulnerabilities were discovered in the gaim instant
     messenger program by Steffan Esser, versions 0.75 and earlier.
     Thanks to Jacques A. Vidrine for providing initial patches.
     
     Multiple buffer overflows exist in gaim 0.75 and earlier: When
     parsing cookies in a Yahoo web connection; YMSG protocol overflows
     parsing the Yahoo login webpage; a YMSG packet overflow; flaws in
     the URL parser; and flaws in the HTTP Proxy connect (CAN-2004-006).
     
     A buffer overflow in gaim 0.74 and earlier in the Extract Info Field
     Function used for MSN and YMSG protocol handlers (CAN-2004-007).
     
     An integer overflow in gaim 0.74 and earlier, when allocating memory
     for a directIM packet results in a heap overflow (CAN-2004-0008).
     _______________________________________________________________________

     References:

      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0006
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0007
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0008
     ______________________________________________________________________

     Updated Packages:
      
     Mandrake Linux 9.1:
     0556c9ec718b1c801812d2dfa03e3c1f 9.1/RPMS/gaim-0.75-1.1.91mdk.i586.rpm
     0bafaeff1aa44729acce297d983751b5 9.1/RPMS/gaim-encrypt-0.75-1.1.91mdk.i586.rpm
     9230e03e6b063ea8dee4c12c7533e934 9.1/RPMS/libgaim-remote0-0.75-1.1.91mdk.i586.rpm
     f8365a246c5f519e3b04acf5c356fbde 9.1/RPMS/libgaim-remote0-devel-0.75-1.1.91mdk.i586.rpm
     9165b41b33f51a1132eb2437e6fbc06a 9.1/SRPMS/gaim-0.75-1.1.91mdk.src.rpm

     Mandrake Linux 9.1/PPC:
     f94e8bffa283f929dd24622f37785e87 ppc/9.1/RPMS/gaim-0.75-1.1.91mdk.ppc.rpm
     a1e2f92c9d3e90efe682832acd2b7913 ppc/9.1/RPMS/gaim-encrypt-0.75-1.1.91mdk.ppc.rpm
     bc3f3ff23f63c7886e67cafb8c5d09e8 ppc/9.1/RPMS/libgaim-remote0-0.75-1.1.91mdk.ppc.rpm
     be2ef1b00eda2d96b67c4f59e8257a79 ppc/9.1/RPMS/libgaim-remote0-devel-0.75-1.1.91mdk.ppc.rpm
     9165b41b33f51a1132eb2437e6fbc06a ppc/9.1/SRPMS/gaim-0.75-1.1.91mdk.src.rpm

     Mandrake Linux 9.2:
     0898eae6994c34bc5338befc5c3e054e 9.2/RPMS/gaim-0.75-1.1.92mdk.i586.rpm
     fc6d3ffb544effe5d22c476e8a3ed6de 9.2/RPMS/gaim-encrypt-0.75-1.1.92mdk.i586.rpm
     2dcf56db1cfee1408e60ae873c78231d 9.2/RPMS/gaim-festival-0.75-1.1.92mdk.i586.rpm
     c9320a7b72ff220c7222185138b87aab 9.2/RPMS/gaim-perl-0.75-1.1.92mdk.i586.rpm
     3e736129d087a844ce7580ae67bbca73 9.2/RPMS/libgaim-remote0-0.75-1.1.92mdk.i586.rpm
     8630b36c277296aca4340cd99c158fc4 9.2/RPMS/libgaim-remote0-devel-0.75-1.1.92mdk.i586.rpm
     204f4ba2d9bd6c9037377f4e8903c621 9.2/SRPMS/gaim-0.75-1.1.92mdk.src.rpm

     Mandrake Linux 9.2/AMD64:
     0ad839bfc084c7a8b13d1498239c81d4 amd64/9.2/RPMS/gaim-0.75-1.1.92mdk.amd64.rpm
     52babbdbd27f99041cf29ef67e9eecc9 amd64/9.2/RPMS/gaim-encrypt-0.75-1.1.92mdk.amd64.rpm
     e32a9b3b1c72a59a24a0cea2e4b1c05e amd64/9.2/RPMS/gaim-festival-0.75-1.1.92mdk.amd64.rpm
     ed2aef050fabfb8a401be136f551b6c0 amd64/9.2/RPMS/gaim-perl-0.75-1.1.92mdk.amd64.rpm
     aed398efb4623d541c90627e20c17abf amd64/9.2/RPMS/lib64gaim-remote0-0.75-1.1.92mdk.amd64.rpm
     9eccc2dbba74055a9235a54c00904e88 amd64/9.2/RPMS/lib64gaim-remote0-devel-0.75-1.1.92mdk.amd64.rpm
     204f4ba2d9bd6c9037377f4e8903c621 amd64/9.2/SRPMS/gaim-0.75-1.1.92mdk.src.rpm
     _______________________________________________________________________

     To upgrade automatically use MandrakeUpdate or urpmi. The verification
     of md5 checksums and GPG signatures is performed automatically for you.

     A list of FTP mirrors can be obtained from:

      http://www.mandrakesecure.net/en/ftp.php

     All packages are signed by MandrakeSoft for security. You can obtain
     the GPG public key of the Mandrake Linux Security Team by executing:

      gpg --recv-keys --keyserver www.mandrakesecure.net 0x22458A98

     Please be aware that sometimes it takes the mirrors a few hours to
     update.

     You can view other update advisories for Mandrake Linux at:

      http://www.mandrakesecure.net/en/advisories/

     MandrakeSoft has several security-related mailing list services that
     anyone can subscribe to. Information on these lists can be obtained by
     visiting:

      http://www.mandrakesecure.net/en/mlist.php

     If you want to report vulnerabilities, please contact

      security_linux-mandrake.com

     Type Bits/KeyID Date User ID
     pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
      <security linux-mandrake.com>
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.7 (GNU/Linux)

    iD8DBQFAFbX8mqjQ0CJFipgRAlzQAKC1pem4i1b92gdoZZzjCoNAgmd9eACeKBs5
    GOLeBCQEvF23gFMoElbFeA8=
    =fvrJ
    -----END PGP SIGNATURE-----


  • Next message: lion: "[HUC] Serv-U FTPD 3.x/4.x "SITE CHMOD" Command remote exploit V1.0"

    Relevant Pages