CVE-2009-1373

Executive Summary

Informations
Name	CVE-2009-1373	First vendor Publication	2009-05-26
Vendor	Cve	Last vendor Modification	2010-08-21

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:S/C:C/I:C/A:C)
Cvss Base Score	7.1	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	High
Cvss Expoit Score	3.9	Authentification	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1373

CWE : Common Weakness Enumeration

id	Name
CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:9005

Oval ID:	oval:org.mitre.oval:def:9005
Title:	Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
Description:	Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-1373	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND pidgin is earlier than 0:1.5.1-3.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section finch-devel is earlier than 0:2.5.5-2.el4 AND libpurple is earlier than 0:2.5.5-2.el4 AND libpurple-perl is earlier than 0:2.5.5-2.el4 AND libpurple-tcl is earlier than 0:2.5.5-2.el4 AND pidgin-devel is earlier than 0:2.5.5-2.el4 AND libpurple-devel is earlier than 0:2.5.5-2.el4 AND finch is earlier than 0:2.5.5-2.el4 AND pidgin-perl is earlier than 0:2.5.5-2.el4 AND pidgin is earlier than 0:2.5.5-2.el4 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section finch-devel is earlier than 0:2.5.5-3.el5 AND libpurple is earlier than 0:2.5.5-3.el5 AND libpurple-perl is earlier than 0:2.5.5-3.el5 AND libpurple-tcl is earlier than 0:2.5.5-3.el5 AND pidgin-devel is earlier than 0:2.5.5-3.el5 AND libpurple-devel is earlier than 0:2.5.5-3.el5 AND finch is earlier than 0:2.5.5-3.el5 AND pidgin-perl is earlier than 0:2.5.5-3.el5 AND pidgin is earlier than 0:2.5.5-3.el5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Pidgin Pidgin cpe:/a:pidgin:pidgin:2.5.5 cpe:/a:pidgin:pidgin:2.5.4 cpe:/a:pidgin:pidgin:2.5.3 cpe:/a:pidgin:pidgin:2.5.2 cpe:/a:pidgin:pidgin:2.5.1 cpe:/a:pidgin:pidgin:2.5.0 cpe:/a:pidgin:pidgin:2.4.3 cpe:/a:pidgin:pidgin:2.4.2 cpe:/a:pidgin:pidgin:2.4.1 cpe:/a:pidgin:pidgin:2.4.0 cpe:/a:pidgin:pidgin:2.3.1 cpe:/a:pidgin:pidgin:2.3.0 cpe:/a:pidgin:pidgin:2.2.2 cpe:/a:pidgin:pidgin:2.2.1 cpe:/a:pidgin:pidgin:2.2.0 cpe:/a:pidgin:pidgin:2.1.1 cpe:/a:pidgin:pidgin:2.1.0 cpe:/a:pidgin:pidgin:2.0.2 cpe:/a:pidgin:pidgin:2.0.2::linux cpe:/a:pidgin:pidgin:2.0.1 cpe:/a:pidgin:pidgin:2.0.0	21

Open Source Vulnerability Database (OSVDB)

id	Description
54646	Pidgin XMPP SOCKS5 Bytestream Server File Transfer Remote Overflow

Internal Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/35067
CONFIRM	http://www.pidgin.im/news/security/?id=29 https://bugzilla.redhat.com/show_bug.cgi?id=500488
DEBIAN	http://debian.org/security/2009/dsa-1805
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html
GENTOO	http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:140 http://www.mandriva.com/security/advisories?name=MDVSA-2009:173
REDHAT	http://www.redhat.com/support/errata/RHSA-2009-1059.html http://www.redhat.com/support/errata/RHSA-2009-1060.html
SECUNIA	http://secunia.com/advisories/35188 http://secunia.com/advisories/35194 http://secunia.com/advisories/35202 http://secunia.com/advisories/35215 http://secunia.com/advisories/35294 http://secunia.com/advisories/35329 http://secunia.com/advisories/35330
UBUNTU	http://www.ubuntu.com/usn/USN-781-1 http://www.ubuntu.com/usn/USN-781-2
VUPEN	http://www.vupen.com/english/advisories/2009/1396
XF	http://xforce.iss.net/xforce/xfdb/50682

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-10 23:49:15	Multiple Updates

Type	Count
Oval ID(s)	1
CPE ID(s)	21
osvdb(s)	1

Related	Severity
MDVSA-2009:321	(Critical)
USN-781-2	(Critical)
USN-781-1	(Critical)
RHSA-2009:1060	(Critical)
RHSA-2009:1059	(Critical)
MDVSA-2009:173	(Critical)
MDVSA-2009:140	(Critical)
GLSA-200905-07	(Critical)
DSA-1805	(Critical)