Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2009-3085 | First vendor Publication | 2009-09-08 |
Vendor | Cve | Last vendor Modification | 2017-09-19 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
---|---|---|---|
Cvss Base Score | 5 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3085 |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:11223 | |||
Oval ID: | oval:org.mitre.oval:def:11223 | ||
Title: | The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images. | ||
Description: | The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-3085 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22854 | |||
Oval ID: | oval:org.mitre.oval:def:22854 | ||
Title: | ELSA-2009:1453: pidgin security update (Moderate) | ||
Description: | The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2009:1453-01 CVE-2009-2703 CVE-2009-3026 CVE-2009-3083 CVE-2009-3085 | Version: | 21 |
Platform(s): | Oracle Linux 5 | Product(s): | pidgin |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28765 | |||
Oval ID: | oval:org.mitre.oval:def:28765 | ||
Title: | RHSA-2009:1453 -- pidgin security update (Moderate) | ||
Description: | Updated pidgin packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. Info/Query (IQ) is an Extensible Messaging and Presence Protocol (XMPP) specific request-response mechanism. A NULL pointer dereference flaw was found in the way the Pidgin XMPP protocol plug-in processes IQ error responses when trying to fetch a custom smiley. A remote client could send a specially-crafted IQ error response that would crash Pidgin. (CVE-2009-3085) | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2009:1453 CESA-2009:1453-CentOS 5 CVE-2009-2703 CVE-2009-3026 CVE-2009-3083 CVE-2009-3085 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4 CentOS Linux 5 | Product(s): | pidgin |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:6434 | |||
Oval ID: | oval:org.mitre.oval:def:6434 | ||
Title: | Pidgin before 2.6.2 allow denial of service via XHTML-IM content | ||
Description: | The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley, which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2009-3085 | Version: | 3 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Pidgin |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2011-08-09 | Name : CentOS Update for finch CESA-2009:1453 centos4 i386 File : nvt/gb_CESA-2009_1453_finch_centos4_i386.nasl |
2011-08-09 | Name : CentOS Update for finch CESA-2009:1453 centos5 i386 File : nvt/gb_CESA-2009_1453_finch_centos5_i386.nasl |
2010-05-28 | Name : Fedora Update for pidgin FEDORA-2010-8523 File : nvt/gb_fedora_2010_8523_pidgin_fc11.nasl |
2010-03-02 | Name : Fedora Update for pidgin FEDORA-2010-0429 File : nvt/gb_fedora_2010_0429_pidgin_fc11.nasl |
2010-03-02 | Name : Fedora Update for pidgin FEDORA-2010-1279 File : nvt/gb_fedora_2010_1279_pidgin_fc11.nasl |
2010-01-20 | Name : Ubuntu Update for pidgin vulnerabilities USN-886-1 File : nvt/gb_ubuntu_USN_886_1.nasl |
2009-12-10 | Name : Mandriva Security Advisory MDVSA-2009:321 (pidgin) File : nvt/mdksa_2009_321.nasl |
2009-12-03 | Name : SLES11: Security update for pidgin File : nvt/sles11_cdparanoia.nasl |
2009-10-27 | Name : Fedora Core 11 FEDORA-2009-10662 (pidgin) File : nvt/fcore_2009_10662.nasl |
2009-10-27 | Name : Fedora Core 10 FEDORA-2009-10702 (pidgin) File : nvt/fcore_2009_10702.nasl |
2009-09-28 | Name : RedHat Security Advisory RHSA-2009:1453 File : nvt/RHSA_2009_1453.nasl |
2009-09-28 | Name : CentOS Security Advisory CESA-2009:1453 (pidgin) File : nvt/ovcesa2009_1453.nasl |
2009-09-15 | Name : Mandrake Security Advisory MDVSA-2009:230 (pidgin) File : nvt/mdksa_2009_230.nasl |
2009-09-15 | Name : Pidgin Multiple Denial Of Service Vulnerabilities (Linux) File : nvt/secpod_pidgin_mult_dos_vuln_lin.nasl |
2009-09-15 | Name : Pidgin Multiple Denial Of Service Vulnerabilities (Win) File : nvt/secpod_pidgin_mult_dos_vuln_win.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
57786 | Pidgin XMPP Protocol Plugin Crafted Smiley Parsing Remote DoS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1453.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090921_pidgin_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_finch-6709.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_finch-6710.nasl - Type : ACT_GATHER_INFO |
2010-01-19 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-886-1.nasl - Type : ACT_GATHER_INFO |
2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1453.nasl - Type : ACT_GATHER_INFO |
2009-12-08 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_finch-080606.nasl - Type : ACT_GATHER_INFO |
2009-12-08 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_finch-081203.nasl - Type : ACT_GATHER_INFO |
2009-12-08 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_finch-091024.nasl - Type : ACT_GATHER_INFO |
2009-12-07 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-321.nasl - Type : ACT_GATHER_INFO |
2009-12-03 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_finch-090221.nasl - Type : ACT_GATHER_INFO |
2009-09-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1453.nasl - Type : ACT_GATHER_INFO |
2009-09-14 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-230.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
Date | Informations |
---|---|
2020-05-23 01:40:50 |
|
2020-05-23 00:24:17 |
|
2019-06-05 12:02:28 |
|
2018-09-25 12:07:17 |
|
2017-09-19 09:23:23 |
|
2016-04-26 19:05:24 |
|
2014-02-17 10:51:32 |
|
2013-05-10 23:56:47 |
|