A stored cross-site scripting (XSS) flaw was found in the way Kadu, the instant messenger compatible with the Gadu-Gadu protocol, performed sanitization of status and sms messages for particular contact in user's history. A remote attacker could provide a specially-crafted status or sms message, which would be stored in victim's Kadu history file, if the attacker was present on the contact list of the victim and the victim has had storage of statuses enabled for their history file. When the victim later examined the content of the status history, this flaw could lead to arbitrary HTML or webscript execution.

References: [1] https://bugzilla.novell.com/showbug.cgi?id=749036

Upstream patches: [2] https://gitorious.org/kadu/kadu/commit/ebe3674cf0f3aa9b36308c06e19cb293cc790b52 (patch for the XSS issue)

[3] https://gitorious.org/kadu/kadu/commit/e9506be6d3dcdd408fdf83d8eb82416c9b798c84 (additional hardening)

[4] https://gitorious.org/kadu/kadu/commit/91772e46541e22cbc2c7bf41a1a9798c2a58f6d6 (disable xhtmlrequests)

[5] https://gitorious.org/kadu/kadu/commit/94e7479617d78a1649a0763960edade7ad09a0d0 (allow only GET and HEADER requests, additional hardening)

A stored cross-site scripting (XSS) flaw was found in the way Kadu, the instant messenger compatible with the Gadu-Gadu protocol, performed sanitization of status and sms messages for particular contact in user's history. A remote attacker could provide a specially-crafted status or sms message, which would be stored in victim's Kadu history file, if the attacker was present on the contact list of the victim and the victim has had storage of statuses enabled for their history file. When the victim later examined the content of the status history, this flaw could lead to arbitrary HTML or webscript execution.

References: [1] https://bugzilla.novell.com/showbug.cgi?id=749036

Upstream patches: [2] https://gitorious.org/kadu/kadu/commit/ebe3674cf0f3aa9b36308c06e19cb293cc790b52 (patch for the XSS issue)

[3] https://gitorious.org/kadu/kadu/commit/e9506be6d3dcdd408fdf83d8eb82416c9b798c84 (additional hardening)

[4] https://gitorious.org/kadu/kadu/commit/91772e46541e22cbc2c7bf41a1a9798c2a58f6d6 (disable xhtmlrequests)

[5] https://gitorious.org/kadu/kadu/commit/94e7479617d78a1649a0763960edade7ad09a0d0 (allow only GET and HEADER requests, additional hardening)

Kadu 0.4.3 allows remote attackers to cause a denial of service (application crash) via a large number of image send requests.

Kadu 0.4.2 and 0.5.0pre allows remote attackers to cause a denial of service (crash or generated traffic) via a malformed message, possibly with incomplete information.

Multiple integer overflows in libgadu, as used in Kopete in KDE 3.2.3 to 3.4.1, ekg before 1.6rc3, GNU Gadu, CenterICQ, Kadu, and other packages, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an incoming message.