Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the name, which is not properly handled in a call to the gnomemeetingloginsert function.

Multiple format string vulnerabilities in the gmmainwindowflashmessage function in Ekiga before 2.0.5 allow attackers to cause a denial of service and possibly execute arbitrary code via a crafted Q.931 SETUP packet.

Ekiga versions before 3.3.0 attempted to load a module from /tmp/ekigatest.so.

A denial of service flaw was found in the way Ekiga, a Gnome based SIP/H323 teleconferencing application, processed information from certain OPAL connections (UTF-8 strings were not verified for validity prior showing them). A remote attacker (other party with a not UTF-8 valid name) could use this flaw to cause ekiga executable crash.

Upstream bug report: [1] https://bugzilla.gnome.org/showbug.cgi?id=653009

Relevant upstream patch: [2] http://git.gnome.org/browse/ekiga/commit/?id=7d09807257

References: [3] http://ftp.gnome.org/pub/gnome/sources/ekiga/4.0/ekiga-4.0.0.news

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-4897 to the following vulnerability:

The SIPURL::GetHostAddress function in Ekiga (formerly GnomeMeeting) 2.0.5 and earlier allows remote attackers to cause a denial of service (application crash) via unspecified vectors, related to "bad management of memory allocation."

References: http://www.securityfocus.com/bid/25642 http://www.s21sec.com/avisos/s21sec-036-en.txt http://marc.info/?l=full-disclosure&m=118959114522339&w=2

Note: Advisory posted to full-disclosure stated versions 2.0.5 and prior are vulnerable. s21sec site seems to have updated advisory stating version 2.0.7 is also vulnerable.

The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."

José Miguel Esparza discovered that insufficient input validation is performed on SIP protocol header field 'Content-Length' by opal library used by ekiga. This flaw can be used to write '\0' byte to attacker-controlled address and crash ekiga. Ekiga 2.0.10 using opal library 2.2.10 was released to address this issue.

Ekiga 2.0.10 release notes: http://mail.gnome.org/archives/ekiga-list/2007-September/msg00103.html

CVS commit pointed out by upstream: http://openh323.cvs.sourceforge.net/openh323/opal/src/sip/sippdu.cxx?r1=2.83.2.19&r2=2.83.2.20&pathrev=Phobos (some of the previous commits may be required to get complete checks / fix)

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-4897 to the following vulnerability:

The SIPURL::GetHostAddress function in Ekiga (formerly GnomeMeeting) 2.0.5 and earlier allows remote attackers to cause a denial of service (application crash) via unspecified vectors, related to "bad management of memory allocation."

References: http://www.securityfocus.com/bid/25642 http://www.s21sec.com/avisos/s21sec-036-en.txt http://marc.info/?l=full-disclosure&m=118959114522339&w=2

Note: Advisory posted to full-disclosure stated versions 2.0.5 and prior are vulnerable. s21sec site seems to have updated advisory stating version 2.0.7 is also vulnerable.

Open Phone Abstraction Library (opal) is implementation of varioustelephony and video communication protocols for use over packet based networks.In Red Hat Enterprise Linux 5, the Ekiga application uses opal.A flaw was discovered in the way opal handled certain Session Initiation Protocol (SIP) packets. An attacker could use this flaw to crash an application, such as Ekiga, which is linked with opal. (CVE-2007-4924)Users should upgrade to these updated opal packages which contain a backported patch to correct this issue.