KLA10171 Multiple vulnerabilities in Gadu-Gadu

Multiple serious vulnerabilities have been found in Gadu-Gadu. Malicious can use these vulnerabilities to obtain sensitive information or cause denial of service Below is a complete list of vulnerabilities

1. Vectors related to Easycall can be exploited remotely via outgoing calls;
2. A buffer overflow can be exploited remotely via a specially designed image filename;
3. Vectors related to unknown activities can be exploited remotely via a specially designed web page;
4. Vectors related to unknown activities can be exploited remotely via specially designed DCC packets;
5. Improper device name handling can be exploited remotely via a specially designed filename.

Original advisories

Related products

Gadu-Gadu

CVE list

CVE-2005-3887 high

CVE-2005-3889 critical

CVE-2005-3888 critical

CVE-2005-3891 critical

CVE-2005-3890 critical

CVE-2005-3892 critical

Solution

Update to latest version

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

• Gadu-Gadu version 7.20