PT-2002-1439 · Gaim · Gaim

Published 2002-05-29 · Updated 2016-10-18 · CVE-2002-0377

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gaim version 0.57

Description The issue allows local users to access sensitive information, including MSN web email accounts of other users, by reading authentication data from files in the /tmp directory. This is possible because Gaim stores sensitive information in world-readable and group-writable files.

Recommendations For Gaim version 0.57, consider restricting access to the /tmp directory or modifying the file permissions to prevent unauthorized access until a patch is available. As a temporary workaround, avoid using Gaim to access MSN web email accounts until the issue is resolved.

Fix

Related Identifiers

CVE-2002-0377

Affected Products

Gaim

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2002-0377 · Security Note
• http://gaim.sourceforge.net/ChangeLog · Vendor Advisory
• http://marc.info/?l=bugtraq&m=102130733815285&w=2 · Note
• http://iss.net/security_center/static/9061.php · Note
• http://archives.neohapsis.com/archives/vuln-dev/2002-q2/0584.html · Note
• http://securityfocus.com/bid/4730 · Note