Submitted by KeesCook on Thu, 2008-12-18 00:11
Referenced CVEs:
CVE-2008-4776
Description:
===========================================================
Ubuntu Security Notice USN-692-1 December 17, 2008
ekg, libgadu vulnerability
CVE-2008-4776
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
libgadu3 1:1.6+20051103-1ubuntu1.1
Ubuntu 7.10:
libgadu3 1:1.7~rc2-2ubuntu0.7.10.1
Ubuntu 8.04 LTS:
libgadu3 1:1.7~rc2-2ubuntu0.8.04.1
Ubuntu 8.10:
libgadu3 1:1.8.0+r592-1ubuntu0.1
After a standard system upgrade you need to restart your session to effect
the necessary changes.
Details follow:
It was discovered that the Gadu library, used by some Instant Messaging
clients, did not correctly verify certain packet sizes from the server.
If a user connected to a malicious server, clients using Gadu could be
made to crash, leading to a denial of service.
