Gentoo Logo

GNU Gadu, CenterICQ, Kadu, EKG, libgadu: Remote code execution in Gadu library

Content:

1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 200507-26 / gnugadu centericq kadu ekg libgadu
Release Date July 27, 2005
Latest Revision February 26, 2007: 02
Impact high
Exploitable remote
Package Vulnerable versions Unaffected versions Architecture(s)
net-im/gnugadu < 2.2.6-r1 >= 2.2.6-r1 All supported architectures
net-im/centericq < 4.20.0-r3 >= 4.20.0-r3 All supported architectures
net-im/kadu < 0.4.1 >= 0.4.1 All supported architectures
net-im/ekg < 1.6_rc3 >= 1.6_rc3 All supported architectures
net-libs/libgadu < 1.7.0_pre20050719 >= 1.7.0_pre20050719 All supported architectures

Related bugreports: #99816, #99890, #99583

Synopsis

GNU Gadu, CenterICQ, Kadu, EKG and libgadu are vulnerable to an integer overflow which could potentially lead to the execution of arbitrary code or a Denial of Service.

2.  Impact Information

Background

GNU Gadu, CenterICQ, Kadu and EKG are instant messaging applications created to support Gadu Gadu instant messaging protocol. libgadu is a library that implements the client side of the Gadu-Gadu protocol.

Description

GNU Gadu, CenterICQ, Kadu, EKG and libgadu are vulnerable to an integer overflow.

Impact

A remote attacker could exploit the integer overflow to execute arbitrary code or cause a Denial of Service.

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All GNU Gadu users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/gnugadu-2.2.6-r1"

All Kadu users should upgrade to the latest version:

Code Listing 3.2: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/kadu-0.4.1"

All EKG users should upgrade to the latest version:

Code Listing 3.3: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/ekg-1.6_rc3"

All libgadu users should upgrade to the latest version:

Code Listing 3.4: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/libgadu-20050719"

All CenterICQ users should upgrade to the latest version:

Code Listing 3.5: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/centericq-4.20.0-r3"

CenterICQ is no longer distributed with Gadu Gadu support, affected users are encouraged to migrate to an alternative package.

4.  References



Print

Page updated July 27, 2005

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.

Copyright 2001-2014 Gentoo Foundation, Inc. Questions, Comments? Contact us.