PT-2004-1236 · Gaim · Gaim
CVE-2004-0005
·
Publicado
2004-02-03
·
Atualizado
2024-02-16
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Gaim version 0.75
Description
The issue involves multiple buffer overflows that allow remote attackers to cause a denial of service and possibly execute arbitrary code. This can occur through various means, including octal encoding in
yahoo decode that causes a null byte to be written beyond the buffer, and quoted printable encoding in gaim quotedp decode that causes a pointer to reference memory beyond the terminating null byte.Recommendations
For Gaim version 0.75, consider disabling the
yahoo decode and gaim quotedp decode functions until a patch is available to prevent potential exploitation. Restrict access to quoted printable strings in the gaim quotedp decode MIME decoder to minimize the risk of buffer overflows. Avoid using octal encoding in yahoo decode until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Gaim