PT-2004-1237 · Yahoo · Yahoo

Published 2004-01-29 · Updated 2017-10-11 · CVE-2004-0006

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gaim versions 0.75 and earlier Ultramagnetic versions prior to 0.81

Description The issue concerns multiple buffer overflows that can be triggered by remote attackers, potentially leading to a denial of service or the execution of arbitrary code. The overflows can occur through various means, including cookies in a Yahoo web connection, a long name parameter in the Yahoo login web page, a long value parameter in the Yahoo login page, a YMSG packet, the URL parser, and HTTP proxy connect.

Recommendations For Gaim versions 0.75 and earlier, update to a version later than 0.75 to resolve the issue. For Ultramagnetic versions prior to 0.81, update to version 0.81 or later to resolve the issue.

Fix

Related Identifiers

CVE-2004-0006

DSA-434

Affected Products

Yahoo

References · 35

• http://ultramagnetic.sourceforge.net/advisories/001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-032.html · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc · Vendor Advisory
• http://debian.org/security/2004/dsa-434 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.361158 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:006 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-045.html · Vendor Advisory
• http://security.e-matters.de/advisories/012004.html · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20040201-01-U.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0006 · Security Note
• http://redhat.com/support/errata/RHSA-2004-033.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2004_04_gaim.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200401-04.xml · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000813 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14943 · Note