Abrir sesión
logo

DEFENSA FRENTE A LAS CIBERAMENAZAS

barra-separadora

Boletines de Vulnerabilidades


Denegación de servicio en libgadu

Clasificación de la vulnerabilidad

Propiedad Valor
Nivel de Confianza Oficial
Impacto Denegación de Servicio
Dificultad Experto
Requerimientos del atacante Acceso remoto sin cuenta a un servicio exotico

Información sobre el sistema

Propiedad Valor
Fabricante afectado GNU/Linux
Software afectado libgadu

Descripción

Se ha descubierto una vulnerabilidad en libgadu, una librería que ofrece soporte para el protocolo de mensajería instantánea Gadu Gadu.

La vulnerabilidad reside en un error de alineamiento de memoria que puede provocar, bajo determinadas arquitecturas, cómo Sparc, errores de bus.

La explotación de esta vulnerabilidad podría permitir a un atacante remoto provocar una situación de denegación de servicio.

Gaim es un ejemplo de aplicación que utiliza libgadu y que, por tanto, es vulnerable.

Solución



Actualización de software

Debian Linux (gaim)

Debian Linux 3.1
Source
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4.dsc
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4.diff.gz
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1.orig.tar.gz
Architecture independent
http://security.debian.org/pool/updates/main/g/gaim/gaim-data_1.2.1-1.4_all.deb
Alpha
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_alpha.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_alpha.deb
ARM
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_arm.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_arm.deb
Intel IA-32
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_i386.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_i386.deb
Intel IA-64
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_ia64.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_ia64.deb
HP Precision
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_hppa.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_hppa.deb
Motorola 680x0
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_m68k.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_m68k.deb
Big endian MIPS
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_mips.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_mips.deb
Little endian MIPS
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_mipsel.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_mipsel.deb
PowerPC
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_powerpc.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_powerpc.deb
IBM S/390
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_s390.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_s390.deb
Sun Sparc
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_sparc.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_sparc.deb

Red Hat Linux (gaim)
Red Hat Desktop (v. 3)
Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux WS (v. 3)
Red Hat Enterprise Linux WS (v. 4)
https://rhn.redhat.com/

Debian

Debian Linux 3.1
AMD64
http://security.debian.org/pool/updates/main/g/gaim/gaim_1.2.1-1.4_amd64.deb
http://security.debian.org/pool/updates/main/g/gaim/gaim-dev_1.2.1-1.4_amd64.deb

SGI
SGI Advanced Linux Environment 3
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/RPMS
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/SRPMS

Mandriva Linux

Mandrakelinux 10.1
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/gaim-1.5.0-0.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/gaim-devel-1.5.0-0.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/gaim-gevolution-1.5.0-0.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/gaim-perl-1.5.0-0.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/gaim-tcl-1.5.0-0.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/libgaim-remote0-1.5.0-0.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/libgaim-remote0-devel-1.5.0-0.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/SRPMS/gaim-1.5.0-0.1.101mdk.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/gaim-1.5.0-0.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/gaim-devel-1.5.0-0.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/gaim-gevolution-1.5.0-0.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/gaim-perl-1.5.0-0.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/gaim-tcl-1.5.0-0.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/lib64gaim-remote0-1.5.0-0.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/lib64gaim-remote0-devel-1.5.0-0.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/SRPMS/gaim-1.5.0-0.1.101mdk.src.rpm

Corporate Server 3.0
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/gaim-1.5.0-0.1.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/gaim-devel-1.5.0-0.1.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/gaim-perl-1.5.0-0.1.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/gaim-tcl-1.5.0-0.1.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/libgaim-remote0-1.5.0-0.1.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/libgaim-remote0-devel-1.5.0-0.1.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/gaim-1.5.0-0.1.C30mdk.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/gaim-1.5.0-0.1.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/gaim-devel-1.5.0-0.1.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/gaim-perl-1.5.0-0.1.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/gaim-tcl-1.5.0-0.1.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/lib64gaim-remote0-1.5.0-0.1.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/lib64gaim-remote0-devel-1.5.0-0.1.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/SRPMS/gaim-1.5.0-0.1.C30mdk.src.rpm

Mandrivalinux LE2005
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/gaim-1.5.0-0.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/gaim-devel-1.5.0-0.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/gaim-gevolution-1.5.0-0.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/gaim-perl-1.5.0-0.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/gaim-silc-1.5.0-0.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/gaim-tcl-1.5.0-0.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/libgaim-remote0-1.5.0-0.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/libgaim-remote0-devel-1.5.0-0.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/SRPMS/gaim-1.5.0-0.1.102mdk.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/gaim-1.5.0-0.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/gaim-devel-1.5.0-0.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/gaim-gevolution-1.5.0-0.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/gaim-perl-1.5.0-0.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/gaim-silc-1.5.0-0.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/gaim-tcl-1.5.0-0.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/lib64gaim-remote0-1.5.0-0.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/lib64gaim-remote0-devel-1.5.0-0.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/SRPMS/gaim-1.5.0-0.1.102mdk.src.rpm

Debian (centericq)

Debian Linux 3.1
Source
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2.dsc
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2.diff.gz
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0.orig.tar.gz
Alpha
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_alpha.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_alpha.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_alpha.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_alpha.deb
AMD64
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_amd64.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_amd64.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_amd64.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_amd64.deb
ARM
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_arm.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_arm.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_arm.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_arm.deb
Intel IA-32
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_i386.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_i386.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_i386.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_i386.deb
Intel IA-64
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_ia64.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_ia64.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_ia64.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_ia64.deb
HP Precision
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_hppa.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_hppa.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_hppa.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_hppa.deb
Motorola 680x0
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_m68k.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_m68k.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_m68k.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_m68k.deb
Big endian MIPS
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_mips.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_mips.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_mips.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_mips.deb
Little endian MIPS
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_mipsel.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_mipsel.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_mipsel.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_mipsel.deb
PowerPC
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_powerpc.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_powerpc.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_powerpc.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_powerpc.deb
IBM S/390
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_s390.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_s390.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_s390.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_s390.deb
Sun Sparc
http://security.debian.org/pool/updates/main/c/centericq/centericq_4.20.0-1sarge2_sparc.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-common_4.20.0-1sarge2_sparc.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-fribidi_4.20.0-1sarge2_sparc.deb
http://security.debian.org/pool/updates/main/c/centericq/centericq-utf8_4.20.0-1sarge2_sparc.deb

Identificadores estándar

Propiedad Valor
CVE CAN-2005-2370
BID NULL

Recursos adicionales

Debian Security Advisory DSA 769-1
http://lists.debian.org/debian-security-announce/debian-security-announce-2005/msg00156.html

Red Hat Security Advisory RHSA-2005:627-11
https://rhn.redhat.com/errata/RHSA-2005-627.html

Debian Security Advisory DSA 773-1
http://lists.debian.org/debian-security-announce/debian-security-announce-2005/msg00160.html

SGI Security advisory 20050802-01-U
ftp://patches.sgi.com/support/free/security/advisories/20050802-01-U.asc

Mandriva Security Advisories MDKSA-2005:139
http://www.mandriva.com/security/advisories?name=MDKSA-2005:139

Debian Security Advisory (DSA 813-1)
http://lists.debian.org/debian-security-announce/debian-security-announce-2005/msg00203.html

Histórico de versiones

Versión Comentario Fecha
1.0 Aviso emitido 2005-07-29
1.1 Aviso emitido por Red Hat (RHSA-2005:627-11) 2005-08-11
1.2 Aviso emitido por Debian (DSA 773-1). Aviso emitido por SGI (20050802-01-U). Aviso emitido por Mandriva (MDKSA-2005:139) 2005-08-26
1.3 Aviso emitido por Debian (DSA 813-1) 2005-09-21
Volver

Este sitio web utiliza cookies propias y de terceros para el correcto funcionamiento y visualización del sitio web por parte del usuario, así como la recogida de estadísticas. Si continúa navegando, consideramos que acepta su uso. Puede cambiar la configuración u obtener más información. Modificar configuración