Gaim is a multi-protocol instant messenger available for a number of operating systems. It supports a variety of instant messaging protocols, including the Yahoo Messenger (YMSG) protocol. There is an off-by-one buffer overflow vulnerability in the yahoo_decode() function. This function fails to properly decode octal values used for email notification functions. By supplying a specially crafted octal value, an unauthenticated, remote attacker may be able to cause a null byte to be overwritten.
An unauthenticated, remote attacker may cause a denial of service or potentially execute code of the attacker's choice.
This vulnerability was publicly reported by Stefan Esser of e-matters.
This document was written by Damon Morda.
|Date First Published:||2004-04-30|
|Date Last Updated:||2004-05-06 18:20 UTC|