Vulnerability Note VU#297198

Gaim fails to properly validate the "value" parameter in the Yahoo login webpage

Overview

There is a buffer overflow vulnerability in the way the Gaim yahoo_login_page_hash() function parses the "value" parameter in the Yahoo login webpage.

I. Description

Gaim is a multi-protocol instant messenger available for a number of operating systems. It supports a variety of instant messaging protocols, including the Yahoo Messenger (YMSG) protocol. There is a buffer overflow vulnerability in the yahoo_login_page_hash() function of Gaim's YMSG protocol. When parsing the Yahoo login webpage, the yahoo_login_page_hash() function fails to perform proper bounds checking on the "value" parameter. Although the source of these values should originate from a site controlled by Yahoo, an attacker may use several techniques (DNS spoofing, man-in-the-middle, etc.) to modify the values returned to the victim.

II. Impact

An attacker with the ability to control the "value" parameter returned to the victim could execute arbitrary code with the privileges of the vulnerable process.

III. Solution

Upgrade

Upgrade to Gaim version 0.76 or later.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Gaim	Vulnerable	6-May-2004

References

http://security.e-matters.de/advisories/012004.html
http://www.debian.org/security/2004/dsa-434
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000813
http://www.secunia.com/advisories/10705/

Credit

This vulnerability was publicly reported by Stefan Esser of e-matters.

This document was written by Damon Morda.

Other Information

Date Public:	2004-01-26
Date First Published:	2004-05-06
Date Last Updated:	2004-05-06
CERT Advisory:
CVE-ID(s):	CAN-2004-0006
NVD-ID(s):	CAN-2004-0006
US-CERT Technical Alerts:
Metric:	6.56
Document Revision:	11

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader