Gaim fixes critical security flaws

Users of Gaim, the multiplatform instant messaging application, should upgrade to a new version to protect themselves from three newly discovered security holes.

Gaim 1.5.0 was released on Thursday. It fixes a flaw in the way Gaim processes a setting in AOL Instant Messenger (AIM) and ICQ showing a user is away from their machine. A malicious attacker could run a large number of "%n" symbols in their away message and trigger a buffer overflow when the Gaim user ran their mouse over this text. This could then allow the attacker to run malicious code on the Gaim user's PC.

A second problem, in the way Gaim handled file transfers, could also be exploited to crash the application. The third flaw, in a protocol handler, was less serious and didn't affect users on x86 machines.

The new version of Gaim can be downloaded from its homepage here.

Security firm Secunia and Linux distributor Red Hat have both urged users to upgrade. Red Hat issued its own patch on Thursday, for Red Hat Desktop and Red Hat Enterprise users.

Gaim runs on Linux, BSD, MacOS X, and Windows, and is compatible with AIM, ICQ, MSN Messenger, Yahoo, IRC, Jabber, Gadu-Gadu, and Zephyr. Gaim lets users log into multiple accounts on multiple IM networks simultaneously.