发布日期：2004-01-26
更新日期：2004-02-04

受影响系统：

Ultramagnetic Ultramagnetic 1.0
Rob Flynn Gaim 0.75
    - Linux系统  
    - Unix系统

描述：

---

BUGTRAQ  ID: 9489
CVE(CAN) ID: CVE-2004-0006

Gaim是一款能多种协议进行即时通信的程序，Ultramagnetic是Gaim的派生程序。

Gaim对多种协议进行通信时存在边界条件错误问题，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可能未授权访问使用此软件的主机系统。

在审核Gaim源代码时发现存在12个安全问题，具体如下：

YMSG协议(yahoo messenger)处理器存在缓冲区溢出：

   01) Yahoo Octal-Encoding Decoder缓冲溢出
   02) Yahoo Octal-Encoding Decoder越界缓冲区溢出
   03) Yahoo Web Cookie解析缓冲区溢出
   04) Yahoo登录页名解析缓冲区溢出            
   05) Yahoo登录页值解析缓冲区溢出            
   06) Yahoo包解析解析缓冲区溢出            

oscar协议(AIM)处理器存在缓冲区溢出：

   07) AIM/Oscar DirectIM整数溢出
   08) quoted-printable编码解析溢出
   09) Quoted Printable编码解析越界溢出
   10) URL解析函数溢出            
   11) 展开Info字段函数溢出
   12) HTTP代理连接溢出

<*来源：Stefan Esser （s.esser@ematters.de）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=107513690306318&w=2
        http://www.linux-mandrake.com/en/security/2004/2004-006.php
                https://www.redhat.com/support/errata/RHSA-2004-032.html
*>

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* 第三方补丁下载如下：

http://security.e-matters.de/patches/gaim-0.75-fix.diff

厂商补丁：

MandrakeSoft
------------
MandrakeSoft已经为此发布了一个安全公告（MDKSA-2004:006-1）以及相应补丁:
MDKSA-2004:006-1：Updated gaim packages fix multiple vulnerabilities
链接：http://www.linux-mandrake.com/en/security/2004/2004-006.php

补丁下载：

Updated Packages:

Mandrake Linux 9.1:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/gaim-0.75-1.2.91mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/gaim-encrypt-0.75-1.2.91mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/libgaim-remote0-0.75-1.2.91mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/RPMS/libgaim-remote0-devel-0.75-1.2.91mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.1/SRPMS/gaim-0.75-1.2.91mdk.src.rpm

Mandrake Linux 9.1/PPC:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/gaim-0.75-1.2.91mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/gaim-encrypt-0.75-1.2.91mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/libgaim-remote0-0.75-1.2.91mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/RPMS/libgaim-remote0-devel-0.75-1.2.91mdk.ppc.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/ppc/9.1/SRPMS/gaim-0.75-1.2.91mdk.src.rpm

Mandrake Linux 9.2:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/gaim-0.75-1.2.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/gaim-encrypt-0.75-1.2.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/gaim-festival-0.75-1.2.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/gaim-perl-0.75-1.2.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/libgaim-remote0-0.75-1.2.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/libgaim-remote0-devel-0.75-1.2.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/SRPMS/gaim-0.75-1.2.92mdk.src.rpm

Mandrake Linux 9.2/AMD64:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/gaim-0.75-1.2.92mdk.amd64.rpm

上述升级软件还可以在下列地址中的任意一个镜像ftp服务器上下载：
http://www.mandrakesecure.net/en/ftp.php

RedHat
------
RedHat已经为此发布了一个安全公告（RHSA-2004:032-01）以及相应补丁:
RHSA-2004:032-01：Updated Gaim packages fix various vulnerabiliies
链接：https://www.redhat.com/support/errata/RHSA-2004-032.html

补丁下载：

Red Hat Linux 9:

SRPMS:
ftp://updates.redhat.com/9/en/os/SRPMS/gaim-0.75-0.9.0.src.rpm

i386:
ftp://updates.redhat.com/9/en/os/i386/gaim-0.75-0.9.0.i386.rpm
可使用下列命令安装补丁：

rpm -Fvh [文件名]

S.u.S.E.
--------
S.u.S.E.已经为此发布了一个安全公告（SuSE-SA:2004:004）以及相应补丁:
SuSE-SA:2004:004：gaim
链接：

补丁下载：

    Intel i386 Platform:

    SuSE-9.0:
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gaim-0.67-65.i586.rpm
      09f8d12dd52e246cf32dca8ad3374f39
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gaim-0.67-65.i586.patch.rpm
      3a633e341b9e56facdbe0250b55dd33a
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/gaim-0.67-65.src.rpm
      5ee6a86077c0297a64815532782f7a54

    SuSE-8.2:
    ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/gaim-0.59.8-60.i586.rpm
      7a269744304f72bf951c7bd6974560f2
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/gaim-0.59.8-60.i586.patch.rpm
      e7b18f0da02c1c4392dc1b03e835a827
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/gaim-0.59.8-60.src.rpm
      ae7d7b1c9735696244547a0d6a5ee92e

    SuSE-8.1:
    ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/gaim-0.59-158.i586.rpm
      22b1d4be5737906f8ff0975918279034
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/gaim-0.59-158.i586.patch.rpm
      7644020869e92cc980b881efebf9d617
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/gaim-0.59-158.src.rpm
      cd1532f71a79ed32d016d456a844ff4b

    SuSE-8.0:
    ftp://ftp.suse.com/pub/suse/i386/update/8.0/gnm3/gaim-0.50-187.i386.rpm
      7dcb581b78bf8ab61e82bf0836a4357e
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/8.0/gnm3/gaim-0.50-187.i386.patch.rpm
      5a6f596538edc56e0b3a70a23200c21e
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/gaim-0.50-187.src.rpm
      d38c8da629941eecef7f75d6a5ea9e80

浏览次数：3710
严重程度：0（网友投票）