ID CVE-2005-0966 Type cve Reporter cve@mitre.org Modified 2018-10-19T15:31:00
Description
The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite, or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown, irc_msg_nochan functions.
{"osvdb": [{"lastseen": "2017-04-28T13:20:11", "bulletinFamily": "software", "cvelist": ["CVE-2005-0966"], "edition": 1, "description": "## Vulnerability Description\nGaim contains a flaw that may allow a remote attacker to inject arbitrary Gaim markup. The issue is triggered due to multiple functions of the IRC protocol plugin. It is possible that the flaw may allow a remote attacker to inject arbitrary Gaim markups over IRC resulting in a loss of integrity.\n## Solution Description\nUpgrade to version 1.2.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nGaim contains a flaw that may allow a remote attacker to inject arbitrary Gaim markup. The issue is triggered due to multiple functions of the IRC protocol plugin. It is possible that the flaw may allow a remote attacker to inject arbitrary Gaim markups over IRC resulting in a loss of integrity.\n## References:\nVendor URL: http://gaim.sourceforge.net/\n[Vendor Specific Advisory URL](http://gaim.sourceforge.net/security/index.php?id=14)\n[Vendor Specific Advisory URL](http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000949)\n[Vendor Specific Advisory URL](http://www.ubuntulinux.org/support/documentation/usn/usn-106-1)\nSecurity Tracker: 1013711\n[Secunia Advisory ID:14815](https://secuniaresearch.flexerasoftware.com/advisories/14815/)\n[Secunia Advisory ID:14952](https://secuniaresearch.flexerasoftware.com/advisories/14952/)\n[Secunia Advisory ID:15059](https://secuniaresearch.flexerasoftware.com/advisories/15059/)\n[Secunia Advisory ID:16050](https://secuniaresearch.flexerasoftware.com/advisories/16050/)\n[Secunia Advisory ID:15364](https://secuniaresearch.flexerasoftware.com/advisories/15364/)\n[Secunia Advisory ID:14947](https://secuniaresearch.flexerasoftware.com/advisories/14947/)\n[Related OSVDB ID: 15278](https://vulners.com/osvdb/OSVDB:15278)\n[Related OSVDB ID: 15279](https://vulners.com/osvdb/OSVDB:15279)\n[Related OSVDB ID: 15276](https://vulners.com/osvdb/OSVDB:15276)\n[Related OSVDB ID: 15280](https://vulners.com/osvdb/OSVDB:15280)\nOther Advisory URL: http://www.securiteam.com/unixfocus/5JP010UFFG.html\nOther Advisory URL: http://rhn.redhat.com/errata/RHSA-2005-365.html\nOther Advisory URL: http://lists.suse.com/archive/suse-security-announce/2005-Jul/0004.html\nOther Advisory URL: http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.358635\nOther Advisory URL: http://security.gentoo.org/glsa/glsa-200504-05.xml\nOther Advisory URL: http://www.mandrakesoft.com/security/advisories?name=MDKSA-2005:071\nOther Advisory URL: http://www.slackware.org/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.363712\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-04/0011.html\n[CVE-2005-0966](https://vulners.com/cve/CVE-2005-0966)\n", "modified": "2005-04-01T00:00:00", "published": "2005-04-01T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:15277", "id": "OSVDB:15277", "title": "Gaim IRC Plugin Multiple Function Arbitrary Gaim Markup Injection", "type": "osvdb", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:11", "bulletinFamily": "software", "cvelist": ["CVE-2005-0966"], "edition": 1, "description": "## Solution Description\nUpgrade to version 1.2.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\nVendor URL: http://gaim.sourceforge.net/\n[Vendor Specific Advisory URL](http://gaim.sourceforge.net/security/index.php?id=14)\n[Vendor Specific Advisory URL](http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000949)\nSecurity Tracker: 1013711\n[Secunia Advisory ID:14815](https://secuniaresearch.flexerasoftware.com/advisories/14815/)\n[Secunia Advisory ID:14952](https://secuniaresearch.flexerasoftware.com/advisories/14952/)\n[Secunia Advisory ID:15059](https://secuniaresearch.flexerasoftware.com/advisories/15059/)\n[Secunia Advisory ID:16050](https://secuniaresearch.flexerasoftware.com/advisories/16050/)\n[Secunia Advisory ID:15364](https://secuniaresearch.flexerasoftware.com/advisories/15364/)\n[Secunia Advisory ID:14848](https://secuniaresearch.flexerasoftware.com/advisories/14848/)\n[Secunia Advisory ID:14947](https://secuniaresearch.flexerasoftware.com/advisories/14947/)\n[Related OSVDB ID: 15277](https://vulners.com/osvdb/OSVDB:15277)\n[Related OSVDB ID: 15278](https://vulners.com/osvdb/OSVDB:15278)\n[Related OSVDB ID: 15276](https://vulners.com/osvdb/OSVDB:15276)\n[Related OSVDB ID: 15280](https://vulners.com/osvdb/OSVDB:15280)\nOther Advisory URL: http://www.securiteam.com/unixfocus/5JP010UFFG.html\nOther Advisory URL: http://rhn.redhat.com/errata/RHSA-2005-365.html\nOther Advisory URL: http://lists.suse.com/archive/suse-security-announce/2005-Jul/0004.html\nOther Advisory URL: http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.358635\nOther Advisory URL: http://security.gentoo.org/glsa/glsa-200504-05.xml\nOther Advisory URL: http://www.mandrakesoft.com/security/advisories?name=MDKSA-2005:071\nOther Advisory URL: http://www.slackware.org/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.363712\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-04/0011.html\n[CVE-2005-0966](https://vulners.com/cve/CVE-2005-0966)\n", "modified": "2005-04-02T04:02:49", "published": "2005-04-02T04:02:49", "href": "https://vulners.com/osvdb/OSVDB:15279", "id": "OSVDB:15279", "title": "Gaim irc_msg_invite Function Arbitrary Pango Markup Injection", "type": "osvdb", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:11", "bulletinFamily": "software", "cvelist": ["CVE-2005-0966"], "edition": 1, "description": "## Solution Description\nUpgrade to version 1.2.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\nVendor URL: http://gaim.sourceforge.net/\n[Vendor Specific Advisory URL](http://gaim.sourceforge.net/security/index.php?id=14)\n[Vendor Specific Advisory URL](http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000949)\nSecurity Tracker: 1013711\n[Secunia Advisory ID:14815](https://secuniaresearch.flexerasoftware.com/advisories/14815/)\n[Secunia Advisory ID:14952](https://secuniaresearch.flexerasoftware.com/advisories/14952/)\n[Secunia Advisory ID:15059](https://secuniaresearch.flexerasoftware.com/advisories/15059/)\n[Secunia Advisory ID:16050](https://secuniaresearch.flexerasoftware.com/advisories/16050/)\n[Secunia Advisory ID:15364](https://secuniaresearch.flexerasoftware.com/advisories/15364/)\n[Secunia Advisory ID:14848](https://secuniaresearch.flexerasoftware.com/advisories/14848/)\n[Secunia Advisory ID:14947](https://secuniaresearch.flexerasoftware.com/advisories/14947/)\n[Related OSVDB ID: 15277](https://vulners.com/osvdb/OSVDB:15277)\n[Related OSVDB ID: 15278](https://vulners.com/osvdb/OSVDB:15278)\n[Related OSVDB ID: 15279](https://vulners.com/osvdb/OSVDB:15279)\n[Related OSVDB ID: 15276](https://vulners.com/osvdb/OSVDB:15276)\nOther Advisory URL: http://rhn.redhat.com/errata/RHSA-2005-365.html\nOther Advisory URL: http://lists.suse.com/archive/suse-security-announce/2005-Jul/0004.html\nOther Advisory URL: http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.358635\nOther Advisory URL: http://security.gentoo.org/glsa/glsa-200504-05.xml\nOther Advisory URL: http://www.mandrakesoft.com/security/advisories?name=MDKSA-2005:071\nOther Advisory URL: http://www.slackware.org/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.363712\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-04/0011.html\n[CVE-2005-0966](https://vulners.com/cve/CVE-2005-0966)\n", "modified": "2005-04-02T04:02:49", "published": "2005-04-02T04:02:49", "href": "https://vulners.com/osvdb/OSVDB:15280", "id": "OSVDB:15280", "title": "Gaim IRC Server Arbitrary Pango Markup Injection", "type": "osvdb", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2017-07-02T21:10:14", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966"], "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2016-09-19T00:00:00", "published": "2008-09-04T00:00:00", "id": "OPENVAS:52141", "href": "http://plugins.openvas.org/nasl.php?oid=52141", "type": "openvas", "title": "FreeBSD Ports: gaim, ja-gaim, ko-gaim, ru-gaim", "sourceData": "#\n#VID ec09baa3-a9f5-11d9-a788-0001020eed82\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following packages are affected:\n gaim\n ja-gaim\n ko-gaim\n ru-gaim\n\nCVE-2005-0966\nThe IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions,\nallows (1) remote attackers to inject arbitrary Gaim markup via\nirc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote\nattackers to inject arbitrary Pango markup and pop up empty dialog\nboxes via irc_msg_invite, or (3) malicious IRC servers to cause a\ndenial of service (application crash) by injecting certain Pango\nmarkup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown,\nirc_msg_nochan functions.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://gaim.sourceforge.net/security/?id=14\nhttp://www.vuxml.org/freebsd/ec09baa3-a9f5-11d9-a788-0001020eed82.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(52141);\n script_version(\"$Revision: 4112 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-19 15:17:59 +0200 (Mon, 19 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2005-0966\");\n script_bugtraq_id(13003);\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n script_name(\"FreeBSD Ports: gaim, ja-gaim, ko-gaim, ru-gaim\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"gaim\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.2.1\")<0) {\n txt += 'Package gaim version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"ja-gaim\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.2.1\")<0) {\n txt += 'Package ja-gaim version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"ko-gaim\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.2.1\")<0) {\n txt += 'Package ko-gaim version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"ru-gaim\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.2.1\")<0) {\n txt += 'Package ru-gaim version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:50:20", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966", "CVE-2005-0965", "CVE-2005-0967"], "description": "The remote host is missing updates announced in\nadvisory GLSA 200504-05.", "modified": "2017-07-07T00:00:00", "published": "2008-09-24T00:00:00", "id": "OPENVAS:54907", "href": "http://plugins.openvas.org/nasl.php?oid=54907", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200504-05 (Gaim)", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Gaim contains multiple vulnerabilities that can lead to a Denial of\nService.\";\ntag_solution = \"All Gaim users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-im/gaim-1.2.1'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200504-05\nhttp://bugs.gentoo.org/show_bug.cgi?id=87903\nhttp://gaim.sourceforge.net/security/\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200504-05.\";\n\n \n\nif(description)\n{\n script_id(54907);\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_cve_id(\"CVE-2005-0967\", \"CVE-2005-0966\", \"CVE-2005-0965\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n script_name(\"Gentoo Security Advisory GLSA 200504-05 (Gaim)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"net-im/gaim\", unaffected: make_list(\"ge 1.2.1\"), vulnerable: make_list(\"lt 1.2.1\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2021-01-07T10:51:18", "description": "The GAIM team reports :\n\nThe IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions,\nallows (1) remote attackers to inject arbitrary Gaim markup via\nirc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote\nattackers to inject arbitrary Pango markup and pop up empty dialog\nboxes via irc_msg_invite, or (3) malicious IRC servers to cause a\ndenial of service (application crash) by injecting certain Pango\nmarkup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown,\nirc_msg_nochan functions.", "edition": 25, "published": "2005-07-13T00:00:00", "title": "FreeBSD : gaim -- remote DoS on receiving certain messages over IRC (ec09baa3-a9f5-11d9-a788-0001020eed82)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966"], "modified": "2005-07-13T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:ko-gaim", "p-cpe:/a:freebsd:freebsd:gaim", "cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:ja-gaim", "p-cpe:/a:freebsd:freebsd:ru-gaim"], "id": "FREEBSD_PKG_EC09BAA3A9F511D9A7880001020EED82.NASL", "href": "https://www.tenable.com/plugins/nessus/19153", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(19153);\n script_version(\"1.17\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2005-0966\");\n script_bugtraq_id(13003);\n\n script_name(english:\"FreeBSD : gaim -- remote DoS on receiving certain messages over IRC (ec09baa3-a9f5-11d9-a788-0001020eed82)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The GAIM team reports :\n\nThe IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions,\nallows (1) remote attackers to inject arbitrary Gaim markup via\nirc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote\nattackers to inject arbitrary Pango markup and pop up empty dialog\nboxes via irc_msg_invite, or (3) malicious IRC servers to cause a\ndenial of service (application crash) by injecting certain Pango\nmarkup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown,\nirc_msg_nochan functions.\"\n );\n # http://gaim.sourceforge.net/security/?id=14\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.pidgin.im/news/security/?id=14\"\n );\n # https://vuxml.freebsd.org/freebsd/ec09baa3-a9f5-11d9-a788-0001020eed82.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?590251af\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:ja-gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:ko-gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:ru-gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/04/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"gaim<1.2.1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"ja-gaim<1.2.1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"ko-gaim<1.2.1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"ru-gaim<1.2.1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2021-01-12T10:05:49", "description": "http://gaim.sourceforge.net/security/\nhttp://gaim.sourceforge.net/ChangeLog gaim-1.2.1 resolves\nCVE-2005-0965 and CVE-2005-0966 as well as some crashes in the jabber\nand yahoo protocols. Read upstream's pages above for more details.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 23, "published": "2005-09-12T00:00:00", "title": "Fedora Core 3 : gaim-1.2.1-1.fc3 (2005-299)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966", "CVE-2005-0965"], "modified": "2005-09-12T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora_core:3", "p-cpe:/a:fedoraproject:fedora:gaim", "p-cpe:/a:fedoraproject:fedora:gaim-debuginfo"], "id": "FEDORA_2005-299.NASL", "href": "https://www.tenable.com/plugins/nessus/19645", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2005-299.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(19645);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_xref(name:\"FEDORA\", value:\"2005-299\");\n\n script_name(english:\"Fedora Core 3 : gaim-1.2.1-1.fc3 (2005-299)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora Core host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"http://gaim.sourceforge.net/security/\nhttp://gaim.sourceforge.net/ChangeLog gaim-1.2.1 resolves\nCVE-2005-0965 and CVE-2005-0966 as well as some crashes in the jabber\nand yahoo protocols. Read upstream's pages above for more details.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://gaim.sourceforge.net/ChangeLog\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://gaim.sourceforge.net/security/\"\n );\n # https://lists.fedoraproject.org/pipermail/announce/2005-April/000839.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?67e9ac41\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected gaim and / or gaim-debuginfo packages.\"\n );\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gaim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora_core:3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/09/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^3([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 3.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC3\", reference:\"gaim-1.2.1-1.fc3\")) flag++;\nif (rpm_check(release:\"FC3\", reference:\"gaim-debuginfo-1.2.1-1.fc3\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gaim / gaim-debuginfo\");\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2021-01-12T10:05:49", "description": "http://gaim.sourceforge.net/security/\nhttp://gaim.sourceforge.net/ChangeLog gaim-1.2.1 resolves\nCVE-2005-0965 and CVE-2005-0966 as well as some crashes in the jabber\nand yahoo protocols. Read upstream's pages above for more details.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 23, "published": "2005-05-19T00:00:00", "title": "Fedora Core 2 : gaim-1.2.1-1.fc2 (2005-298)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966", "CVE-2005-0965"], "modified": "2005-05-19T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora_core:2", "p-cpe:/a:fedoraproject:fedora:gaim", "p-cpe:/a:fedoraproject:fedora:gaim-debuginfo"], "id": "FEDORA_2005-298.NASL", "href": "https://www.tenable.com/plugins/nessus/18332", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2005-298.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(18332);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_xref(name:\"FEDORA\", value:\"2005-298\");\n\n script_name(english:\"Fedora Core 2 : gaim-1.2.1-1.fc2 (2005-298)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora Core host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"http://gaim.sourceforge.net/security/\nhttp://gaim.sourceforge.net/ChangeLog gaim-1.2.1 resolves\nCVE-2005-0965 and CVE-2005-0966 as well as some crashes in the jabber\nand yahoo protocols. Read upstream's pages above for more details.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://gaim.sourceforge.net/ChangeLog\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://gaim.sourceforge.net/security/\"\n );\n # https://lists.fedoraproject.org/pipermail/announce/2005-April/000838.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e399e025\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected gaim and / or gaim-debuginfo packages.\"\n );\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gaim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora_core:2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/05/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^2([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 2.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC2\", reference:\"gaim-1.2.1-1.fc2\")) flag++;\nif (rpm_check(release:\"FC2\", reference:\"gaim-debuginfo-1.2.1-1.fc2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gaim / gaim-debuginfo\");\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2021-01-20T15:19:11", "description": "Jean-Yves Lefort discovered a buffer overflow in the\ngaim_markup_strip_html() function. This caused Gaim to crash when\nreceiving certain malformed HTML messages. (CAN-2005-0965)\n\nJean-Yves Lefort also noticed that many functions that handle IRC\ncommands do not escape received HTML metacharacters; this allowed\nremote attackers to cause a Denial of Service by injecting arbitrary\nHTML code into the conversation window, popping up arbitrarily many\nempty dialog boxes, or even causing Gaim to crash. (CAN-2005-0966).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 24, "published": "2006-01-15T00:00:00", "title": "Ubuntu 4.10 : gaim vulnerabilities (USN-106-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966", "CVE-2005-0965"], "modified": "2006-01-15T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:4.10", "p-cpe:/a:canonical:ubuntu_linux:gaim"], "id": "UBUNTU_USN-106-1.NASL", "href": "https://www.tenable.com/plugins/nessus/20492", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-106-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(20492);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2005-0965\", \"CVE-2005-0966\");\n script_xref(name:\"USN\", value:\"106-1\");\n\n script_name(english:\"Ubuntu 4.10 : gaim vulnerabilities (USN-106-1)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Jean-Yves Lefort discovered a buffer overflow in the\ngaim_markup_strip_html() function. This caused Gaim to crash when\nreceiving certain malformed HTML messages. (CAN-2005-0965)\n\nJean-Yves Lefort also noticed that many functions that handle IRC\ncommands do not escape received HTML metacharacters; this allowed\nremote attackers to cause a Denial of Service by injecting arbitrary\nHTML code into the conversation window, popping up arbitrarily many\nempty dialog boxes, or even causing Gaim to crash. (CAN-2005-0966).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected gaim package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:4.10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/01/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(4\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 4.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"4.10\", pkgname:\"gaim\", pkgver:\"1.0.0-1ubuntu1.3\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gaim\");\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2021-01-07T10:51:56", "description": "The remote host is affected by the vulnerability described in GLSA-200504-05\n(Gaim: Denial of Service issues)\n\n Multiple vulnerabilities have been addressed in the latest release of\n Gaim:\n A buffer overread in the gaim_markup_strip_html() function,\n which is used when logging conversations (CAN-2005-0965).\n Markup tags are improperly escaped using Gaim's IRC plugin\n (CAN-2005-0966).\n Sending a specially crafted file transfer request to a Gaim Jabber\n user can trigger a crash (CAN-2005-0967).\n \nImpact :\n\n An attacker could possibly cause a Denial of Service by exploiting any\n of these vulnerabilities.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 26, "published": "2005-04-07T00:00:00", "title": "GLSA-200504-05 : Gaim: Denial of Service issues", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966", "CVE-2005-0965", "CVE-2005-0967"], "modified": "2005-04-07T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:gaim"], "id": "GENTOO_GLSA-200504-05.NASL", "href": "https://www.tenable.com/plugins/nessus/17992", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200504-05.\n#\n# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(17992);\n script_version(\"1.18\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2005-0965\", \"CVE-2005-0966\", \"CVE-2005-0967\");\n script_xref(name:\"GLSA\", value:\"200504-05\");\n\n script_name(english:\"GLSA-200504-05 : Gaim: Denial of Service issues\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200504-05\n(Gaim: Denial of Service issues)\n\n Multiple vulnerabilities have been addressed in the latest release of\n Gaim:\n A buffer overread in the gaim_markup_strip_html() function,\n which is used when logging conversations (CAN-2005-0965).\n Markup tags are improperly escaped using Gaim's IRC plugin\n (CAN-2005-0966).\n Sending a specially crafted file transfer request to a Gaim Jabber\n user can trigger a crash (CAN-2005-0967).\n \nImpact :\n\n An attacker could possibly cause a Denial of Service by exploiting any\n of these vulnerabilities.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n # http://gaim.sourceforge.net/security/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.pidgin.im/security/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200504-05\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Gaim users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-im/gaim-1.2.1'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/04/07\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-im/gaim\", unaffected:make_list(\"ge 1.2.1\"), vulnerable:make_list(\"lt 1.2.1\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Gaim\");\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2021-01-07T11:51:26", "description": "More vulnerabilities have been discovered in the gaim instant\nmessaging client :\n\nA buffer overflow vulnerability was found in the way that gaim escapes\nHTML, allowing a remote attacker to send a specially crafted message\nto a gaim client and causing it to crash (CVE-2005-0965).\n\nA bug was discovered in several of gaim's IRC processing functions\nthat fail to properly remove various markup tags within an IRC\nmessage. This could allow a remote attacker to send specially crafted\nmessage to a gaim client connected to an IRC server, causing it to\ncrash (CVE-2005-0966).\n\nFinally, a problem was found in gaim's Jabber message parser that\nwould allow a remote Jabber user to send a specially crafted message\nto a gaim client, bausing it to crash (CVE-2005-0967).\n\nGaim version 1.2.1 is not vulnerable to these issues and is provided\nwith this update.", "edition": 25, "published": "2005-04-15T00:00:00", "title": "Mandrake Linux Security Advisory : gaim (MDKSA-2005:071)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966", "CVE-2005-0965", "CVE-2005-0967"], "modified": "2005-04-15T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:gaim-silc", "p-cpe:/a:mandriva:linux:gaim-tcl", "p-cpe:/a:mandriva:linux:lib64gaim-remote0-devel", "cpe:/o:mandrakesoft:mandrake_linux:10.1", "p-cpe:/a:mandriva:linux:gaim", "p-cpe:/a:mandriva:linux:lib64gaim-remote0", "p-cpe:/a:mandriva:linux:libgaim-remote0-devel", "p-cpe:/a:mandriva:linux:libgaim-remote0", "p-cpe:/a:mandriva:linux:gaim-perl", "x-cpe:/o:mandrakesoft:mandrake_linux:le2005", "p-cpe:/a:mandriva:linux:gaim-gevolution", "p-cpe:/a:mandriva:linux:gaim-devel"], "id": "MANDRAKE_MDKSA-2005-071.NASL", "href": "https://www.tenable.com/plugins/nessus/18052", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2005:071. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(18052);\n script_version(\"1.18\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2005-0965\", \"CVE-2005-0966\", \"CVE-2005-0967\");\n script_xref(name:\"MDKSA\", value:\"2005:071\");\n\n script_name(english:\"Mandrake Linux Security Advisory : gaim (MDKSA-2005:071)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandrake Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"More vulnerabilities have been discovered in the gaim instant\nmessaging client :\n\nA buffer overflow vulnerability was found in the way that gaim escapes\nHTML, allowing a remote attacker to send a specially crafted message\nto a gaim client and causing it to crash (CVE-2005-0965).\n\nA bug was discovered in several of gaim's IRC processing functions\nthat fail to properly remove various markup tags within an IRC\nmessage. This could allow a remote attacker to send specially crafted\nmessage to a gaim client connected to an IRC server, causing it to\ncrash (CVE-2005-0966).\n\nFinally, a problem was found in gaim's Jabber message parser that\nwould allow a remote Jabber user to send a specially crafted message\nto a gaim client, bausing it to crash (CVE-2005-0967).\n\nGaim version 1.2.1 is not vulnerable to these issues and is provided\nwith this update.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gaim-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gaim-gevolution\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gaim-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gaim-silc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gaim-tcl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64gaim-remote0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64gaim-remote0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libgaim-remote0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libgaim-remote0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:10.1\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:mandrakesoft:mandrake_linux:le2005\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/04/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK10.1\", reference:\"gaim-1.2.1-0.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"gaim-devel-1.2.1-0.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"gaim-gevolution-1.2.1-0.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"gaim-perl-1.2.1-0.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"gaim-tcl-1.2.1-0.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"x86_64\", reference:\"lib64gaim-remote0-1.2.1-0.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"x86_64\", reference:\"lib64gaim-remote0-devel-1.2.1-0.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"libgaim-remote0-1.2.1-0.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"libgaim-remote0-devel-1.2.1-0.1.101mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK10.2\", reference:\"gaim-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"gaim-devel-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"gaim-gevolution-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"gaim-perl-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"gaim-silc-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"gaim-tcl-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"x86_64\", reference:\"lib64gaim-remote0-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"x86_64\", reference:\"lib64gaim-remote0-devel-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"i386\", reference:\"libgaim-remote0-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"i386\", reference:\"libgaim-remote0-devel-1.2.1-0.1.102mdk\", yank:\"mdk\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2021-01-17T13:05:27", "description": "An updated gaim package that fixes multiple denial of service issues\nis now available.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe Gaim application is a multi-protocol instant messaging client.\n\nA buffer overflow bug was found in the way gaim escapes HTML. It is\npossible that a remote attacker could send a specially crafted message\nto a Gaim client, causing it to crash. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CVE-2005-0965\nto this issue.\n\nA bug was found in several of gaim's IRC processing functions. These\nfunctions fail to properly remove various markup tags within an IRC\nmessage. It is possible that a remote attacker could send a specially\ncrafted message to a Gaim client connected to an IRC server, causing\nit to crash. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CVE-2005-0966 to this issue.\n\nA bug was found in gaim's Jabber message parser. It is possible for a\nremote Jabber user to send a specially crafted message to a Gaim\nclient, causing it to crash. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CVE-2005-0967 to this\nissue.\n\nIn addition to these denial of service issues, multiple minor upstream\nbugfixes are included in this update.\n\nUsers of Gaim are advised to upgrade to this updated package which\ncontains Gaim version 1.2.1 and is not vulnerable to these issues.", "edition": 29, "published": "2005-04-12T00:00:00", "title": "RHEL 3 / 4 : gaim (RHSA-2005:365)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966", "CVE-2005-0965", "CVE-2005-0967"], "modified": "2005-04-12T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:3", "cpe:/o:redhat:enterprise_linux:4", "p-cpe:/a:redhat:enterprise_linux:gaim"], "id": "REDHAT-RHSA-2005-365.NASL", "href": "https://www.tenable.com/plugins/nessus/18019", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2005:365. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(18019);\n script_version(\"1.27\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2005-0965\", \"CVE-2005-0966\", \"CVE-2005-0967\");\n script_xref(name:\"RHSA\", value:\"2005:365\");\n\n script_name(english:\"RHEL 3 / 4 : gaim (RHSA-2005:365)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated gaim package that fixes multiple denial of service issues\nis now available.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe Gaim application is a multi-protocol instant messaging client.\n\nA buffer overflow bug was found in the way gaim escapes HTML. It is\npossible that a remote attacker could send a specially crafted message\nto a Gaim client, causing it to crash. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CVE-2005-0965\nto this issue.\n\nA bug was found in several of gaim's IRC processing functions. These\nfunctions fail to properly remove various markup tags within an IRC\nmessage. It is possible that a remote attacker could send a specially\ncrafted message to a Gaim client connected to an IRC server, causing\nit to crash. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CVE-2005-0966 to this issue.\n\nA bug was found in gaim's Jabber message parser. It is possible for a\nremote Jabber user to send a specially crafted message to a Gaim\nclient, causing it to crash. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CVE-2005-0967 to this\nissue.\n\nIn addition to these denial of service issues, multiple minor upstream\nbugfixes are included in this update.\n\nUsers of Gaim are advised to upgrade to this updated package which\ncontains Gaim version 1.2.1 and is not vulnerable to these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0965\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0966\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0967\"\n );\n # http://www.securityfocus.com/archive/1/394806/2005-04-01/2005-04-07/0\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.securityfocus.com/archive/1/394806/2005-04-01/2005-04-07/0\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2005:365\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected gaim package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/05/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/04/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(3|4)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 3.x / 4.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2005:365\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL3\", reference:\"gaim-1.2.1-4.el3\")) flag++;\n\n if (rpm_check(release:\"RHEL4\", reference:\"gaim-1.2.1-4.el4\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gaim\");\n }\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}, {"lastseen": "2021-01-06T09:24:48", "description": "An updated gaim package that fixes multiple denial of service issues\nis now available.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe Gaim application is a multi-protocol instant messaging client.\n\nA buffer overflow bug was found in the way gaim escapes HTML. It is\npossible that a remote attacker could send a specially crafted message\nto a Gaim client, causing it to crash. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CVE-2005-0965\nto this issue.\n\nA bug was found in several of gaim's IRC processing functions. These\nfunctions fail to properly remove various markup tags within an IRC\nmessage. It is possible that a remote attacker could send a specially\ncrafted message to a Gaim client connected to an IRC server, causing\nit to crash. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CVE-2005-0966 to this issue.\n\nA bug was found in gaim's Jabber message parser. It is possible for a\nremote Jabber user to send a specially crafted message to a Gaim\nclient, causing it to crash. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CVE-2005-0967 to this\nissue.\n\nIn addition to these denial of service issues, multiple minor upstream\nbugfixes are included in this update.\n\nUsers of Gaim are advised to upgrade to this updated package which\ncontains Gaim version 1.2.1 and is not vulnerable to these issues.", "edition": 27, "published": "2006-07-03T00:00:00", "title": "CentOS 3 / 4 : gaim (CESA-2005:365)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0966", "CVE-2005-0965", "CVE-2005-0967"], "modified": "2006-07-03T00:00:00", "cpe": ["cpe:/o:centos:centos:4", "p-cpe:/a:centos:centos:gaim", "cpe:/o:centos:centos:3"], "id": "CENTOS_RHSA-2005-365.NASL", "href": "https://www.tenable.com/plugins/nessus/21811", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2005:365 and \n# CentOS Errata and Security Advisory 2005:365 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(21811);\n script_version(\"1.22\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2005-0965\", \"CVE-2005-0966\", \"CVE-2005-0967\");\n script_xref(name:\"RHSA\", value:\"2005:365\");\n\n script_name(english:\"CentOS 3 / 4 : gaim (CESA-2005:365)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated gaim package that fixes multiple denial of service issues\nis now available.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe Gaim application is a multi-protocol instant messaging client.\n\nA buffer overflow bug was found in the way gaim escapes HTML. It is\npossible that a remote attacker could send a specially crafted message\nto a Gaim client, causing it to crash. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CVE-2005-0965\nto this issue.\n\nA bug was found in several of gaim's IRC processing functions. These\nfunctions fail to properly remove various markup tags within an IRC\nmessage. It is possible that a remote attacker could send a specially\ncrafted message to a Gaim client connected to an IRC server, causing\nit to crash. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CVE-2005-0966 to this issue.\n\nA bug was found in gaim's Jabber message parser. It is possible for a\nremote Jabber user to send a specially crafted message to a Gaim\nclient, causing it to crash. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CVE-2005-0967 to this\nissue.\n\nIn addition to these denial of service issues, multiple minor upstream\nbugfixes are included in this update.\n\nUsers of Gaim are advised to upgrade to this updated package which\ncontains Gaim version 1.2.1 and is not vulnerable to these issues.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2005-April/011557.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?9eceaa6b\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2005-April/011558.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?94531aea\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2005-April/011559.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c5aa8cb7\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2005-April/011562.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d18e263a\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2005-April/011563.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?75945be1\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected gaim package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:gaim\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/05/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/07/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(3|4)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 3.x / 4.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-3\", reference:\"gaim-1.2.1-4.el3\")) flag++;\n\nif (rpm_check(release:\"CentOS-4\", reference:\"gaim-1.2.1-4.el4\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gaim\");\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}], "freebsd": [{"lastseen": "2019-05-29T18:35:00", "bulletinFamily": "unix", "cvelist": ["CVE-2005-0966"], "description": "\nThe GAIM team reports:\n\nThe IRC protocol plugin in Gaim 1.2.0, and possibly\n\t earlier versions, allows (1) remote attackers to inject\n\t arbitrary Gaim markup via irc_msg_kick, irc_msg_mode,\n\t irc_msg_part, irc_msg_quit, (2) remote attackers to inject\n\t arbitrary Pango markup and pop up empty dialog boxes via\n\t irc_msg_invite, or (3) malicious IRC servers to cause a\n\t denial of service (application crash) by injecting certain\n\t Pango markup into irc_msg_badmode, irc_msg_banned,\n\t irc_msg_unknown, irc_msg_nochan functions.\n\n", "edition": 4, "modified": "2005-04-02T00:00:00", "published": "2005-04-02T00:00:00", "id": "EC09BAA3-A9F5-11D9-A788-0001020EED82", "href": "https://vuxml.freebsd.org/freebsd/ec09baa3-a9f5-11d9-a788-0001020eed82.html", "title": "gaim -- remote DoS on receiving certain messages over IRC", "type": "freebsd", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}], "ubuntu": [{"lastseen": "2020-07-09T17:30:58", "bulletinFamily": "unix", "cvelist": ["CVE-2005-0966", "CVE-2005-0965"], "description": "Jean-Yves Lefort discovered a buffer overflow in the \ngaim_markup_strip_html() function. This caused Gaim to crash when \nreceiving certain malformed HTML messages. (CAN-2005-0965)\n\nJean-Yves Lefort also noticed that many functions that handle IRC \ncommands do not escape received HTML metacharacters; this allowed \nremote attackers to cause a Denial of Service by injecting arbitrary \nHTML code into the conversation window, popping up arbitrarily many \nempty dialog boxes, or even causing Gaim to crash. (CAN-2005-0966)", "edition": 5, "modified": "2005-04-05T00:00:00", "published": "2005-04-05T00:00:00", "id": "USN-106-1", "href": "https://ubuntu.com/security/notices/USN-106-1", "title": "Gaim vulnerabilities", "type": "ubuntu", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:27", "bulletinFamily": "unix", "cvelist": ["CVE-2005-0966", "CVE-2005-0965", "CVE-2005-0967"], "edition": 1, "description": "### Background\n\nGaim is a full featured instant messaging client which handles a variety of instant messaging protocols. \n\n### Description\n\nMultiple vulnerabilities have been addressed in the latest release of Gaim: \n\n * A buffer overread in the gaim_markup_strip_html() function, which is used when logging conversations (CAN-2005-0965).\n * Markup tags are improperly escaped using Gaim's IRC plugin (CAN-2005-0966).\n * Sending a specially crafted file transfer request to a Gaim Jabber user can trigger a crash (CAN-2005-0967).\n\n### Impact\n\nAn attacker could possibly cause a Denial of Service by exploiting any of these vulnerabilities. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll Gaim users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-im/gaim-1.2.1\"", "modified": "2005-04-06T00:00:00", "published": "2005-04-06T00:00:00", "id": "GLSA-200504-05", "href": "https://security.gentoo.org/glsa/200504-05", "type": "gentoo", "title": "Gaim: Denial of Service issues", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}], "centos": [{"lastseen": "2020-07-17T03:28:12", "bulletinFamily": "unix", "cvelist": ["CVE-2005-0966", "CVE-2005-0965", "CVE-2005-0967"], "description": "**CentOS Errata and Security Advisory** CESA-2005:365\n\n\nThe Gaim application is a multi-protocol instant messaging client.\n\nA buffer overflow bug was found in the way gaim escapes HTML. It is\npossible that a remote attacker could send a specially crafted message to a\nGaim client, causing it to crash. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CAN-2005-0965 to this issue.\n\nA bug was found in several of gaim's IRC processing functions. These\nfunctions fail to properly remove various markup tags within an IRC\nmessage. It is possible that a remote attacker could send a specially\ncrafted message to a Gaim client connected to an IRC server, causing it to\ncrash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2005-0966 to this issue.\n\nA bug was found in gaim's Jabber message parser. It is possible for a\nremote Jabber user to send a specially crafted message to a Gaim client,\ncausing it to crash. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0967 to this issue.\n\nIn addition to these denial of service issues, multiple minor upstream\nbugfixes are included in this update.\n\nUsers of Gaim are advised to upgrade to this updated package which contains\nGaim version 1.2.1 and is not vulnerable to these issues.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2005-April/023595.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-April/023596.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-April/023597.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-April/023600.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-April/023601.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-April/023603.html\n\n**Affected packages:**\ngaim\n\n**Upstream details at:**\n\nhttps://rhn.redhat.com/errata/RHSA-2005-365.html", "edition": 5, "modified": "2005-04-12T19:05:29", "published": "2005-04-12T15:08:29", "href": "http://lists.centos.org/pipermail/centos-announce/2005-April/023595.html", "id": "CESA-2005:365", "title": "gaim security update", "type": "centos", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}], "redhat": [{"lastseen": "2019-08-13T18:46:48", "bulletinFamily": "unix", "cvelist": ["CVE-2005-0965", "CVE-2005-0966", "CVE-2005-0967"], "description": "The Gaim application is a multi-protocol instant messaging client.\n\nA buffer overflow bug was found in the way gaim escapes HTML. It is\npossible that a remote attacker could send a specially crafted message to a\nGaim client, causing it to crash. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CAN-2005-0965 to this issue.\n\nA bug was found in several of gaim's IRC processing functions. These\nfunctions fail to properly remove various markup tags within an IRC\nmessage. It is possible that a remote attacker could send a specially\ncrafted message to a Gaim client connected to an IRC server, causing it to\ncrash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2005-0966 to this issue.\n\nA bug was found in gaim's Jabber message parser. It is possible for a\nremote Jabber user to send a specially crafted message to a Gaim client,\ncausing it to crash. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0967 to this issue.\n\nIn addition to these denial of service issues, multiple minor upstream\nbugfixes are included in this update.\n\nUsers of Gaim are advised to upgrade to this updated package which contains\nGaim version 1.2.1 and is not vulnerable to these issues.", "modified": "2017-09-08T12:09:00", "published": "2005-04-12T04:00:00", "id": "RHSA-2005:365", "href": "https://access.redhat.com/errata/RHSA-2005:365", "type": "redhat", "title": "(RHSA-2005:365) gaim security update", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}], "suse": [{"lastseen": "2016-09-04T11:55:38", "bulletinFamily": "unix", "cvelist": ["CVE-2005-0208", "CVE-2005-1934", "CVE-2005-0473", "CVE-2005-0966", "CVE-2005-1409", "CVE-2005-0245", "CVE-2005-0246", "CVE-2005-1269", "CVE-2005-0244", "CVE-2005-0472", "CVE-2005-0965", "CVE-2005-0967", "CVE-2005-0227", "CVE-2005-1262", "CVE-2005-1686", "CVE-2005-1993", "CVE-2005-1410", "CVE-2005-0247"], "description": "Sudo(8) allows the execution of commands as another user and gives the administrator more flexibility than su(1). A race condition in the pathname handling of sudo may allow a local user to execute arbitrary commands. To exploit this bug some conditions need to be fulfilled. The attacking user needs to be listed in the sudoers file, he is able to create symbolic links in the filesystem, and a ALL alias- command needs to follow the attackers entry.\n#### Solution\nIt is recommended to install the updated packages.", "edition": 1, "modified": "2005-06-24T12:44:43", "published": "2005-06-24T12:44:43", "id": "SUSE-SA:2005:036", "href": "http://lists.opensuse.org/opensuse-security-announce/2005-06/msg00024.html", "title": "race condition, arbitrary code execution in sudo", "type": "suse", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}
