A remote overflow exists in Gadu-Gadu. The online chat system fails to check the length of the file name of images, resulting in a stack based buffer overflow. With a specially crafted request, an attacker can cause an overflow of 9 bytes resulting in a loss of availability.
Classification
Location:
Remote / Network Access
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
Solution
Update to version 7 build 22 or higher, as it potentially fixes this vulnerability. At this time, the vendor has not acknowledged the issue or verified a fix is available.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
man.poznan.pl -
PSNC Security Team
