5 - CVE-2009-1374

Executive Summary

Informations
Name	CVE-2009-1374	First vendor Publication	2009-05-26
Vendor	Cve	Last vendor Modification	2017-09-29

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1374

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11654

Oval ID:	oval:org.mitre.oval:def:11654
Title:	Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet.
Description:	Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-1374	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section finch-devel is earlier than 0:2.5.5-2.el4 AND libpurple is earlier than 0:2.5.5-2.el4 AND libpurple-perl is earlier than 0:2.5.5-2.el4 AND libpurple-tcl is earlier than 0:2.5.5-2.el4 AND pidgin-devel is earlier than 0:2.5.5-2.el4 AND libpurple-devel is earlier than 0:2.5.5-2.el4 AND finch is earlier than 0:2.5.5-2.el4 AND pidgin-perl is earlier than 0:2.5.5-2.el4 AND pidgin is earlier than 0:2.5.5-2.el4 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section finch-devel is earlier than 0:2.5.5-3.el5 AND libpurple is earlier than 0:2.5.5-3.el5 AND libpurple-perl is earlier than 0:2.5.5-3.el5 AND libpurple-tcl is earlier than 0:2.5.5-3.el5 AND pidgin-devel is earlier than 0:2.5.5-3.el5 AND libpurple-devel is earlier than 0:2.5.5-3.el5 AND finch is earlier than 0:2.5.5-3.el5 AND pidgin-perl is earlier than 0:2.5.5-3.el5 AND pidgin is earlier than 0:2.5.5-3.el5

Definition Id: oval:org.mitre.oval:def:18201

Oval ID:	oval:org.mitre.oval:def:18201
Title:	Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet
Description:	Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2009-1374	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Pidgin
Definition Synopsis:
Pidgin is installed AND Version of Pidgin less than 2.5.6

CPE : Common Platform Enumeration

Type	Description	Count
Application	Pidgin cpe:2.3:a:pidgin:pidgin:2.5.5:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.5:::::::* cpe:2.3:a:pidgin:pidgin:2.5.4:::::::* cpe:2.3:a:pidgin:pidgin:2.5.4:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.3:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.3:::::::* cpe:2.3:a:pidgin:pidgin:2.5.2:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.5.2:::::::* cpe:2.3:a:pidgin:pidgin:2.5.1:::::::* cpe:2.3:a:pidgin:pidgin:2.5.0:::::::* cpe:2.3:a:pidgin:pidgin:2.5.0:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.3:::::::* cpe:2.3:a:pidgin:pidgin:2.4.3:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.2:::::::* cpe:2.3:a:pidgin:pidgin:2.4.2:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.1:::::::* cpe:2.3:a:pidgin:pidgin:2.4.1:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.0:32_bit:::::: cpe:2.3:a:pidgin:pidgin:2.4.0:::::::* cpe:2.3:a:pidgin:pidgin:2.3.1:::::::* cpe:2.3:a:pidgin:pidgin:2.3.0:::::::* cpe:2.3:a:pidgin:pidgin:2.2.2:::::::* cpe:2.3:a:pidgin:pidgin:2.2.1:::::::* cpe:2.3:a:pidgin:pidgin:2.2.0:::::::* cpe:2.3:a:pidgin:pidgin:2.1.1:::::::* cpe:2.3:a:pidgin:pidgin:2.1.0:::::::* cpe:2.3:a:pidgin:pidgin:2.0.2::linux::::: cpe:2.3:a:pidgin:pidgin:2.0.2:::::::* cpe:2.3:a:pidgin:pidgin:2.0.1:::::::* cpe:2.3:a:pidgin:pidgin:2.0.0:::::::* cpe:2.3:a:pidgin:pidgin:1.5.1:::::::* cpe:2.3:a:pidgin:pidgin:::::::: cpe:2.3:a:pidgin:pidgin:-:::::::*	33

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for finch CESA-2009:1060 centos5 i386 File : nvt/gb_CESA-2009_1060_finch_centos5_i386.nasl
2010-01-20	Name : Ubuntu Update for pidgin vulnerabilities USN-886-1 File : nvt/gb_ubuntu_USN_886_1.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:321 (pidgin) File : nvt/mdksa_2009_321.nasl
2009-10-27	Name : Gentoo Security Advisory GLSA 200910-02 (pidgin) File : nvt/glsa_200910_02.nasl
2009-08-17	Name : Mandrake Security Advisory MDVSA-2009:173 (pidgin) File : nvt/mdksa_2009_173.nasl
2009-07-06	Name : Mandrake Security Advisory MDVSA-2009:147 (pidgin) File : nvt/mdksa_2009_147.nasl
2009-06-23	Name : FreeBSD Ports: pidgin, libpurple, finch File : nvt/freebsd_pidgin.nasl
2009-06-05	Name : Gentoo Security Advisory GLSA 200905-07 (pidgin) File : nvt/glsa_200905_07.nasl
2009-06-05	Name : Ubuntu USN-781-1 (pidgin) File : nvt/ubuntu_781_1.nasl
2009-06-05	Name : Fedora Core 10 FEDORA-2009-5597 (pidgin) File : nvt/fcore_2009_5597.nasl
2009-06-05	Name : Fedora Core 11 FEDORA-2009-5583 (pidgin) File : nvt/fcore_2009_5583.nasl
2009-06-05	Name : Fedora Core 9 FEDORA-2009-5552 (pidgin) File : nvt/fcore_2009_5552.nasl
2009-06-01	Name : Pidgin Multiple Buffer Overflow Vulnerabilities (Linux) File : nvt/secpod_pidgin_mul_bof_vuln_lin.nasl
2009-06-01	Name : Pidgin Multiple Buffer Overflow Vulnerabilities (Win) File : nvt/secpod_pidgin_mul_bof_vuln_win.nasl
2009-05-25	Name : RedHat Security Advisory RHSA-2009:1060 File : nvt/RHSA_2009_1060.nasl
2009-05-25	Name : CentOS Security Advisory CESA-2009:1060 (pidgin) File : nvt/ovcesa2009_1060.nasl
0000-00-00	Name : Slackware Advisory SSA:2009-146-01 pidgin File : nvt/esoft_slk_ssa_2009_146_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
54648	Pidgin QQ Packet Processing decrypt_out() Function Remote DoS

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1060.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090522_pidgin_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2010-01-19	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-886-1.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1060.nasl - Type : ACT_GATHER_INFO
2009-12-07	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-321.nasl - Type : ACT_GATHER_INFO
2009-07-01	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-147.nasl - Type : ACT_GATHER_INFO
2009-06-17	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_b1ca65e65aaf11debc9b0030843d3802.nasl - Type : ACT_GATHER_INFO
2009-06-04	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-781-1.nasl - Type : ACT_GATHER_INFO
2009-06-03	Name : The remote Fedora host is missing a security update. File : fedora_2009-5552.nasl - Type : ACT_GATHER_INFO
2009-06-03	Name : The remote Fedora host is missing a security update. File : fedora_2009-5583.nasl - Type : ACT_GATHER_INFO
2009-06-03	Name : The remote Fedora host is missing a security update. File : fedora_2009-5597.nasl - Type : ACT_GATHER_INFO
2009-05-27	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2009-146-01.nasl - Type : ACT_GATHER_INFO
2009-05-26	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200905-07.nasl - Type : ACT_GATHER_INFO
2009-05-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1060.nasl - Type : ACT_GATHER_INFO
2009-05-22	Name : The remote host is running an instant messaging client that is affected by mu... File : pidgin_2_5_6.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/35067
CONFIRM	http://www.pidgin.im/news/security/?id=30 https://bugzilla.redhat.com/show_bug.cgi?id=500490
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html
GENTOO	http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:173
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://www.redhat.com/support/errata/RHSA-2009-1060.html
SECUNIA	http://secunia.com/advisories/35188 http://secunia.com/advisories/35194 http://secunia.com/advisories/35202 http://secunia.com/advisories/35294 http://secunia.com/advisories/35329
UBUNTU	http://www.ubuntu.com/usn/USN-781-1
VUPEN	http://www.vupen.com/english/advisories/2009/1396
XF	https://exchange.xforce.ibmcloud.com/vulnerabilities/50684

Alert History

If you want to see full details history, please login or register.

Date	Informations
2021-05-04 12:09:27	Multiple Updates
2021-04-22 01:09:48	Multiple Updates
2020-05-23 01:40:19	Multiple Updates
2020-05-23 00:23:40	Multiple Updates
2019-06-05 12:02:21	Multiple Updates
2018-09-25 12:07:10	Multiple Updates
2017-09-29 09:24:11	Multiple Updates
2017-08-17 09:22:33	Multiple Updates
2016-04-26 18:46:30	Multiple Updates
2014-02-17 10:49:46	Multiple Updates
2013-11-04 21:20:42	Multiple Updates
2013-05-10 23:49:15	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	2
CPE ID(s)	33
Sources(s)	19
osvdb(s)	1
Openvas Exploit(s)	17
Nessus® Exploit(s)	15

	Related
10	MDVSA-2009:321
9.3	USN-781-1
9.3	RHSA-2009:1060
9.3	MDVSA-2009:173
9.3	GLSA-200905-07
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 5 more Alert(s)

Copyright Security-Database 2006-2024 - Powered by themself ;) in 0.0516s

Facebook rss twitter linkedin mail