Vulnerabilities > CVE-2009-2694 - Resource Management Errors vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Exploit-Db
| description | Pidgin MSN <= 2.5.8 Remote Code Execution Exploit. CVE-2009-1376,CVE-2009-2694. Remote exploit for windows platform |
| file | exploits/windows/remote/9615.jar |
| id | EDB-ID:9615 |
| last seen | 2016-02-01 |
| modified | 2009-09-09 |
| platform | windows |
| port | |
| published | 2009-09-09 |
| reporter | Pierre Nogues |
| source | https://www.exploit-db.com/download/9615/ |
| title | Pidgin MSN <= 2.5.8 - Remote Code Execution Exploit |
| type | remote |
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2009-10702.NASL description This update fixes : - Bug #529357 - CVE-2009-3615 Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 42195 published 2009-10-22 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42195 title Fedora 10 : pidgin-2.6.3-2.fc10 (2009-10702) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1870.NASL description Federico Muttis discovered that libpurple, the shared library that adds support for various instant messaging networks to the pidgin IM client, is vulnerable to a heap-based buffer overflow. This issue exists because of an incomplete fix for CVE-2008-2927 and CVE-2009-1376. An attacker can exploit this by sending two consecutive SLP packets to a victim via MSN. The first packet is used to create an SLP message object with an offset of zero, the second packet then contains a crafted offset which hits the vulnerable code originally fixed in CVE-2008-2927 and CVE-2009-1376 and allows an attacker to execute arbitrary code. Note: Users with the last seen 2020-06-01 modified 2020-06-02 plugin id 44735 published 2010-02-24 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/44735 title Debian DSA-1870-1 : pidgin - insufficient input validation NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2009-1060.NASL description Updated pidgin packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. A buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol (XMPP). If a Pidgin client initiates a file transfer, and the remote target sends a malformed response, it could cause Pidgin to crash or, potentially, execute arbitrary code with the permissions of the user running Pidgin. This flaw only affects accounts using XMPP, such as Jabber and Google Talk. (CVE-2009-1373) A denial of service flaw was found in Pidgin last seen 2020-06-01 modified 2020-06-02 plugin id 43751 published 2010-01-06 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43751 title CentOS 4 / 5 : pidgin (CESA-2009:1060) NASL family Fedora Local Security Checks NASL id FEDORA_2009-8804.NASL description pidgin upgrade to 2.6.0 for the CVE-2009-2694, insufficient input validation in msn_slplink_process_msg(). 2.6.0 has Voice and Video support via farsight2 (Fedora 11+ only) and numerous other bug fixes. farsight2, libnice and gupnp- igd are version upgrades to make voice and video actually work on Fedora 11. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 40682 published 2009-08-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40682 title Fedora 11 : farsight2-0.0.14-1.fc11 / gupnp-igd-0.1.3-3.fc11 / libnice-0.0.9-1.fc11 / etc (2009-8804) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_59E7AF2D8DB711DE883B001E3300A30D.NASL description Secunia reports : A vulnerability has been reported in Pidgin, which can be exploited by malicious people to potentially compromise a user last seen 2020-06-01 modified 2020-06-02 plugin id 40691 published 2009-08-24 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40691 title FreeBSD : pidgin -- MSN overflow parsing SLP messages (59e7af2d-8db7-11de-883b-001e3300a30d) NASL family Fedora Local Security Checks NASL id FEDORA_2009-8826.NASL description 2.6.1 fixes an issue where pidgin can crash if you are sent a certain type of URL over Yahoo. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 40687 published 2009-08-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40687 title Fedora 10 : pidgin-2.6.1-1.fc10 (2009-8826) NASL family Fedora Local Security Checks NASL id FEDORA_2009-10662.NASL description This update fixes : - Bug #529357 - CVE-2009-3615 Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 42193 published 2009-10-22 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42193 title Fedora 11 : pidgin-2.6.3-2.fc11 (2009-10662) NASL family Fedora Local Security Checks NASL id FEDORA_2010-8523.NASL description 2.7.0 with new features, bug fixes and a security fix for CVE-2010-1624 Full Upstream ChangeLog: * http://developer.pidgin.im/wiki/ChangeLog Fedora packaging changes: * Use System SSL Certificates * Add additional dependencies for Voice + Video Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 47495 published 2010-07-01 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/47495 title Fedora 11 : pidgin-2.7.0-2.fc11 (2010-8523) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200910-02.NASL description The remote host is affected by the vulnerability described in GLSA-200910-02 (Pidgin: Multiple vulnerabilities) Multiple vulnerabilities were found in Pidgin: Yuriy Kaminskiy reported that the OSCAR protocol implementation in Pidgin misinterprets the ICQWebMessage message type as the ICQSMS message type, triggering an allocation of a large amount of memory (CVE-2009-1889). Federico Muttis of Core Security Technologies reported that the msn_slplink_process_msg() function in libpurple/protocols/msn/slplink.c in libpurple as used in Pidgin doesn last seen 2020-06-01 modified 2020-06-02 plugin id 42214 published 2009-10-23 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42214 title GLSA-200910-02 : Pidgin: Multiple vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-886-1.NASL description It was discovered that Pidgin did not properly handle certain topic messages in the IRC protocol handler. If a user were tricked into connecting to a malicious IRC server, an attacker could cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-2703) It was discovered that Pidgin did not properly enforce the last seen 2020-06-01 modified 2020-06-02 plugin id 44057 published 2010-01-19 reporter Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/44057 title Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : pidgin vulnerabilities (USN-886-1) NASL family Fedora Local Security Checks NASL id FEDORA_2009-8791.NASL description pidgin upgrade to 2.6.0 for the CVE-2009-2694, insufficient input validation in msn_slplink_process_msg() and numerous other bug fixes. Fedora 10 does not support voice and video with pidgin-2.6.0. Upgrade to Fedora 11 for this capability. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 40675 published 2009-08-24 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40675 title Fedora 10 : pidgin-2.6.0-1.fc10 (2009-8791) NASL family Fedora Local Security Checks NASL id FEDORA_2010-1279.NASL description 2.6.6 with security and numerous minor bug fixes CVE-2010-0277 CVE-2010-0420 CVE-2010-0423 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 47244 published 2010-07-01 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/47244 title Fedora 11 : pidgin-2.6.6-1.fc11 (2010-1279) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-820-1.NASL description Federico Muttis discovered that Pidgin did not properly handle certain malformed messages in the MSN protocol handler. A remote attacker could send a specially crafted message and possibly execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 40752 published 2009-08-24 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40752 title Ubuntu 8.04 LTS / 8.10 / 9.04 : pidgin vulnerability (USN-820-1) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-1218.NASL description Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. Federico Muttis of Core Security Technologies discovered a flaw in Pidgin last seen 2020-06-01 modified 2020-06-02 plugin id 40639 published 2009-08-20 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40639 title RHEL 3 / 4 / 5 : pidgin (RHSA-2009:1218) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2009-231-02.NASL description New pidgin packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix a security issue. last seen 2020-06-01 modified 2020-06-02 plugin id 40624 published 2009-08-20 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40624 title Slackware 12.0 / 12.1 / 12.2 / current : pidgin (SSA:2009-231-02) NASL family Fedora Local Security Checks NASL id FEDORA_2009-8874.NASL description 2.6.1 fixes an issue where pidgin can crash if you are sent a certain type of URL over Yahoo. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 40689 published 2009-08-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40689 title Fedora 11 : pidgin-2.6.1-1.fc11 (2009-8874) NASL family Scientific Linux Local Security Checks NASL id SL_20090818_PIDGIN_ON_SL3_X.NASL description CVE-2009-2694 pidgin: insufficient input validation in msn_slplink_process_msg() Federico Muttis of Core Security Technologies discovered a flaw in Pidgin last seen 2020-06-01 modified 2020-06-02 plugin id 60644 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60644 title Scientific Linux Security Update : pidgin on SL3.x, SL4.x, SL5.x i386/x86_64 NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2009-321.NASL description Security vulnerabilities has been identified and fixed in pidgin : The NSS plugin in libpurple in Pidgin 2.4.1 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service. (CVE-2008-3532) Pidgin 2.4.1 allows remote attackers to cause a denial of service (crash) via a long filename that contains certain characters, as demonstrated using an MSN message that triggers the crash in the msn_slplink_process_msg function. (CVE-2008-2955) The UPnP functionality in Pidgin 2.0.0, and possibly other versions, allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL. (CVE-2008-2957) Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third-party information (CVE-2009-1373). Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet (CVE-2009-1374). The PurpleCircBuffer implementation in Pidgin (formerly Gaim) before 2.5.6 does not properly maintain a certain buffer, which allows remote attackers to cause a denial of service (memory corruption and application crash) via vectors involving the (1) XMPP or (2) Sametime protocol (CVE-2009-1375). Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin (formerly Gaim) before 2.5.6 on 32-bit platforms allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. NOTE: this issue exists because of an incomplete fix for CVE-2008-2927 (CVE-2009-1376). The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory (CVE-2009-1889). The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376 (CVE-2009-2694). Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM (CVE-2009-3025) protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the require TLS/SSL preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions (CVE-2009-3026). libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of service (NULL pointer dereference and application crash) via a TOPIC message that lacks a topic string (CVE-2009-2703). The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an SLP invite message that lacks certain required fields, as demonstrated by a malformed message from a KMess client (CVE-2009-3083). The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1, as used in Pidgin before 2.6.2, allows remote attackers to cause a denial of service (application crash) via a handwritten (aka Ink) message, related to an uninitialized variable and the incorrect UTF16-LE charset name (CVE-2009-3084). The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images (CVE-2009-3085). This update provides pidgin 2.6.2, which is not vulnerable to these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 43024 published 2009-12-07 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43024 title Mandriva Linux Security Advisory : pidgin (MDVSA-2009:321) NASL family Windows NASL id PIDGIN_2_5_9.NASL description The version of Pidgin installed on the remote host is earlier than 2.5.9. Such versions are reportedly affected by a vulnerability in last seen 2020-06-01 modified 2020-06-02 plugin id 40663 published 2009-08-20 reporter This script is Copyright (C) 2009-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40663 title Pidgin < 2.5.9 'msn_slplink_process_msg()' Memory Corruption NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-1218.NASL description From Red Hat Security Advisory 2009:1218 : Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. Federico Muttis of Core Security Technologies discovered a flaw in Pidgin last seen 2020-06-01 modified 2020-06-02 plugin id 67912 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67912 title Oracle Linux 3 / 4 : pidgin (ELSA-2009-1218) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-1060.NASL description From Red Hat Security Advisory 2009:1060 : Updated pidgin packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. A buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol (XMPP). If a Pidgin client initiates a file transfer, and the remote target sends a malformed response, it could cause Pidgin to crash or, potentially, execute arbitrary code with the permissions of the user running Pidgin. This flaw only affects accounts using XMPP, such as Jabber and Google Talk. (CVE-2009-1373) A denial of service flaw was found in Pidgin last seen 2020-06-01 modified 2020-06-02 plugin id 67863 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67863 title Oracle Linux 4 : pidgin (ELSA-2009-1060) NASL family Fedora Local Security Checks NASL id FEDORA_2010-0429.NASL description - CVE-2010-0013 - A few other bug fixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 47184 published 2010-07-01 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/47184 title Fedora 11 : pidgin-2.6.5-1.fc11 (2010-0429) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2009-230.NASL description Security vulnerabilities has been identified and fixed in pidgin : The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376 (CVE-2009-2694). Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM (CVE-2009-3025) protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the require TLS/SSL preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions (CVE-2009-3026). libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of service (NULL pointer dereference and application crash) via a TOPIC message that lacks a topic string (CVE-2009-2703). The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an SLP invite message that lacks certain required fields, as demonstrated by a malformed message from a KMess client (CVE-2009-3083). The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1, as used in Pidgin before 2.6.2, allows remote attackers to cause a denial of service (application crash) via a handwritten (aka Ink) message, related to an uninitialized variable and the incorrect UTF16-LE charset name (CVE-2009-3084). The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images (CVE-2009-3085). This update provides pidgin 2.6.2, which is not vulnerable to these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 40966 published 2009-09-14 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40966 title Mandriva Linux Security Advisory : pidgin (MDVSA-2009:230) NASL family Solaris Local Security Checks NASL id SOLARIS10_119548-14.NASL description GNOME 2.6.0: Gnome Multi-protocol instant messaging client Patch. Date this patch was last updated by Sun : Dec/14/09 last seen 2020-06-01 modified 2020-06-02 plugin id 107319 published 2018-03-12 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107319 title Solaris 10 (sparc) : 119548-14 NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2009-1218.NASL description Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. Federico Muttis of Core Security Technologies discovered a flaw in Pidgin last seen 2020-06-01 modified 2020-06-02 plugin id 40625 published 2009-08-20 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40625 title CentOS 3 / 5 : pidgin (CESA-2009:1218) NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_119549-14.NASL description GNOME 2.6.0_x86: Gnome Multi-protocol instant messaging client Pat. Date this patch was last updated by Sun : Dec/11/09 last seen 2020-06-01 modified 2020-06-02 plugin id 107822 published 2018-03-12 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107822 title Solaris 10 (x86) : 119549-14 NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-1060.NASL description Updated pidgin packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. A buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol (XMPP). If a Pidgin client initiates a file transfer, and the remote target sends a malformed response, it could cause Pidgin to crash or, potentially, execute arbitrary code with the permissions of the user running Pidgin. This flaw only affects accounts using XMPP, such as Jabber and Google Talk. (CVE-2009-1373) A denial of service flaw was found in Pidgin last seen 2020-06-01 modified 2020-06-02 plugin id 38872 published 2009-05-23 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38872 title RHEL 4 / 5 : pidgin (RHSA-2009:1060)
Oval
accepted 2013-04-29T04:04:37.274-04:00 class vulnerability contributors name Aharon Chernin organization SCAP.com, LLC name Dragos Prisaca organization G2, Inc.
definition_extensions comment The operating system installed on the system is Red Hat Enterprise Linux 3 oval oval:org.mitre.oval:def:11782 comment CentOS Linux 3.x oval oval:org.mitre.oval:def:16651 comment The operating system installed on the system is Red Hat Enterprise Linux 4 oval oval:org.mitre.oval:def:11831 comment CentOS Linux 4.x oval oval:org.mitre.oval:def:16636 comment Oracle Linux 4.x oval oval:org.mitre.oval:def:15990 comment The operating system installed on the system is Red Hat Enterprise Linux 5 oval oval:org.mitre.oval:def:11414 comment The operating system installed on the system is CentOS Linux 5.x oval oval:org.mitre.oval:def:15802 comment Oracle Linux 5.x oval oval:org.mitre.oval:def:15459
description The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376. family unix id oval:org.mitre.oval:def:10319 status accepted submitted 2010-07-09T03:56:16-04:00 title The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376. version 27 accepted 2013-09-09T04:03:42.755-04:00 class vulnerability contributors name Chandan S organization SecPod Technologies name Shane Shaffer organization G2, Inc.
definition_extensions comment Pidgin is installed oval oval:org.mitre.oval:def:12366 description The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376. family windows id oval:org.mitre.oval:def:6320 status accepted submitted 2009-09-24T03:13:11 title Pidgin before 2.5.9 allow denial of service via SLP (aka MSNSLP) messages version 4
Packetstorm
| data source | https://packetstormsecurity.com/files/download/81096/pidginmsn-exec.txt |
| id | PACKETSTORM:81096 |
| last seen | 2016-12-05 |
| published | 2009-09-10 |
| reporter | Pierre Nogues |
| source | https://packetstormsecurity.com/files/81096/Pidgin-MSN-2.5.8-Code-Execution.html |
| title | Pidgin MSN 2.5.8 Code Execution |
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| rpms |
|
Seebug
bulletinFamily exploit description No description provided by source. id SSV:12249 last seen 2017-11-19 modified 2009-09-11 published 2009-09-11 reporter Root source https://www.seebug.org/vuldb/ssvid-12249 title Pidgin MSN <= 2.5.8 Remote Code Execution Exploit bulletinFamily exploit description No description provided by source. id SSV:66870 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-66870 title Pidgin MSN <= 2.5.8 - Remote Code Execution Exploit bulletinFamily exploit description CVE(CAN) ID: CVE-2009-2694 Pidgin是支持多种协议的即时通讯客户端。 Pidgin和其他一些即时消息客户端所使用的Libpurple库中存在内存破坏漏洞，远程攻击者可以通过向聊天客户端发送特制的MSNSLP报文触发这个漏洞，导致执行任意代码。 攻击需要发送两个连续的MSNSLP消息，第一个用于对slpmsg存储会话id，第二个用于触发漏洞，最终目标是到达msn_slplink_process_msg()中的memcpy()调用。需要创建偏移为非0的MSNSLP消息，因为这个值是memcpy()的目标。 因为偏移非0，所以在调用msn_slplink_message_find()返回NULL时会出现第一个问题： /----------- if (offset == 0) { .. construct a new slpmsg .. } else { slpmsg = msn_slplink_message_find(slplink, msg->msnslp_header.session_id, msg->msnslp_header.id); } if (slpmsg == NULL) { /* Probably the transfer was canceled */ purple_debug_error("msn", "Couldn't find slpmsg\n"); return; } - -----------/ 因此，slpmsg必须为非空，这就是为什么需要发送两次消息才能进行攻击。发送的第一个MSNSLP消息偏移为0，用于创建slpmsg对象，Libpurple会存储这个对象；第二个MSNSLP消息的偏移非0，但由于Libpurple已经存储了第一个MSNSLP消息，因此调用msn_slplink_message_find()会有效的返回之前的对象而不是NULL： /----------- if (slpmsg->fp) { /* fseek(slpmsg->fp, offset, SEEK_SET); */ len = fwrite(data, 1, len, slpmsg->fp); } else if (slpmsg->size) { if (G_MAXSIZE - len < offset || (offset='' + len='') > slpmsg->size) { purple_debug_error("msn", "Oversized slpmsg - msgsize=%lld offset=%" G_GSIZE_FORMAT " len=%" G_GSIZE_FORMAT "\n", slpmsg->size, offset, len); g_return_if_reached(); } else memcpy(slpmsg->buffer + offset, data, len); } - -----------/ 例如，如果创建的第一个MSNSLP消息大小为0x01ffffff，第二个消息的偏移为小于0x01ffffff - len的任意值，就满足了任意写入的条件。 最后，以小于0x01ffffff - len的任意偏移值到达了memcpy()，缓冲区指向0。这意味着可以向低于0x01ffffff - len的任意位置写入数据内容。 Rob Flynn Gaim >= 0.79 Pidgin Pidgin 2.5.8 厂商补丁： RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2009:1218-01）以及相应补丁: RHSA-2009:1218-01：Critical: pidgin security update 链接：https://www.redhat.com/support/errata/RHSA-2009-1218.html Pidgin ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.pidgin.im/news/security/?id=34 id SSV:12092 last seen 2017-11-19 modified 2009-08-21 published 2009-08-21 reporter Root title Pidgin Libpurple库msn_slplink_process_msg()函数内存破坏漏洞
References
- http://developer.pidgin.im/viewmtn/revision/info/6f7343166c673bf0496ecb1afec9b633c1d54a0e
- http://developer.pidgin.im/wiki/ChangeLog
- http://secunia.com/advisories/36384
- http://secunia.com/advisories/36392
- http://secunia.com/advisories/36401
- http://secunia.com/advisories/36402
- http://secunia.com/advisories/36708
- http://secunia.com/advisories/37071
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-266908-1
- http://www.coresecurity.com/content/libpurple-arbitrary-write
- http://www.debian.org/security/2009/dsa-1870
- http://www.exploit-db.com/exploits/9615
- http://www.pidgin.im/news/security/?id=34
- http://www.vupen.com/english/advisories/2009/2303
- http://www.vupen.com/english/advisories/2009/2663
- https://bugzilla.redhat.com/show_bug.cgi?id=514957
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10319
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6320
- https://rhn.redhat.com/errata/RHSA-2009-1218.html