Executive Summary

Informations
Name CVE-2010-3711 First vendor Publication 2010-10-27
Vendor Cve Last vendor Modification 2017-09-19

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Cvss Base Score 4 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3711

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12998
 
Oval ID: oval:org.mitre.oval:def:12998
Title: USN-1014-1 -- pidgin vulnerabilities
Description: Pierre Noguès discovered that Pidgin incorrectly handled malformed SLP messages in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. Daniel Atallah discovered that Pidgin incorrectly handled the return code of the Base64 decoding function. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service
Family: unix Class: patch
Reference(s): USN-1014-1
CVE-2010-1624
CVE-2010-3711
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.10
Ubuntu 9.10
Ubuntu 10.04
Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18506
 
Oval ID: oval:org.mitre.oval:def:18506
Title: libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support
Description: libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.
Family: windows Class: vulnerability
Reference(s): CVE-2010-3711
Version: 3
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22271
 
Oval ID: oval:org.mitre.oval:def:22271
Title: RHSA-2010:0788: pidgin security update (Moderate)
Description: libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.
Family: unix Class: patch
Reference(s): RHSA-2010:0788-01
CESA-2010:0788
CVE-2010-1624
CVE-2010-3711
Version: 29
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22323
 
Oval ID: oval:org.mitre.oval:def:22323
Title: RHSA-2010:0890: pidgin security update (Moderate)
Description: libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.
Family: unix Class: patch
Reference(s): RHSA-2010:0890-01
CVE-2010-3711
Version: 4
Platform(s): Red Hat Enterprise Linux 6
Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22964
 
Oval ID: oval:org.mitre.oval:def:22964
Title: ELSA-2010:0788: pidgin security update (Moderate)
Description: libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.
Family: unix Class: patch
Reference(s): ELSA-2010:0788-01
CVE-2010-1624
CVE-2010-3711
Version: 13
Platform(s): Oracle Linux 5
Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23485
 
Oval ID: oval:org.mitre.oval:def:23485
Title: ELSA-2010:0890: pidgin security update (Moderate)
Description: libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.
Family: unix Class: patch
Reference(s): ELSA-2010:0890-01
CVE-2010-3711
Version: 6
Platform(s): Oracle Linux 6
Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27802
 
Oval ID: oval:org.mitre.oval:def:27802
Title: DEPRECATED: ELSA-2010-0890 -- pidgin security update (moderate)
Description: [2.6.6-6.el6] - Add patch for CVE-2010-3711 (RH bug #645413).
Family: unix Class: patch
Reference(s): ELSA-2010-0890
CVE-2010-3711
Version: 4
Platform(s): Oracle Linux 6
Product(s): pidgin
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 48

OpenVAS Exploits

Date Description
2011-09-12 Name : Fedora Update for pidgin FEDORA-2011-11595
File : nvt/gb_fedora_2011_11595_pidgin_fc14.nasl
2011-08-09 Name : CentOS Update for finch CESA-2010:0788 centos5 i386
File : nvt/gb_CESA-2010_0788_finch_centos5_i386.nasl
2011-07-18 Name : Fedora Update for pidgin FEDORA-2011-8917
File : nvt/gb_fedora_2011_8917_pidgin_fc14.nasl
2011-03-24 Name : Fedora Update for pidgin FEDORA-2011-3113
File : nvt/gb_fedora_2011_3113_pidgin_fc14.nasl
2011-03-24 Name : Fedora Update for pidgin FEDORA-2011-3132
File : nvt/gb_fedora_2011_3132_pidgin_fc13.nasl
2011-01-11 Name : Fedora Update for pidgin FEDORA-2010-19314
File : nvt/gb_fedora_2010_19314_pidgin_fc14.nasl
2011-01-11 Name : Fedora Update for pidgin FEDORA-2010-19317
File : nvt/gb_fedora_2010_19317_pidgin_fc13.nasl
2010-12-02 Name : Fedora Update for pidgin FEDORA-2010-16876
File : nvt/gb_fedora_2010_16876_pidgin_fc14.nasl
2010-11-16 Name : Fedora Update for pidgin FEDORA-2010-16629
File : nvt/gb_fedora_2010_16629_pidgin_fc13.nasl
2010-11-16 Name : Fedora Update for pidgin FEDORA-2010-17130
File : nvt/gb_fedora_2010_17130_pidgin_fc12.nasl
2010-11-16 Name : Ubuntu Update for pidgin vulnerabilities USN-1014-1
File : nvt/gb_ubuntu_USN_1014_1.nasl
2010-11-04 Name : CentOS Update for finch CESA-2010:0788 centos4 i386
File : nvt/gb_CESA-2010_0788_finch_centos4_i386.nasl
2010-11-04 Name : Pidgin Libpurple 'purple_base64_decode()' Denial of Service Vulnerabilities (...
File : nvt/gb_pidgin_libpurple_mult_dos_vuln_win.nasl
2010-10-22 Name : RedHat Update for pidgin RHSA-2010:0788-01
File : nvt/gb_RHSA-2010_0788-01_pidgin.nasl
2010-10-22 Name : Mandriva Update for pidgin MDVSA-2010:208 (pidgin)
File : nvt/gb_mandriva_MDVSA_2010_208.nasl
0000-00-00 Name : Slackware Advisory SSA:2010-305-02 pidgin
File : nvt/esoft_slk_ssa_2010_305_02.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
68773 Pidgin Multiple Protocol Plugin purple_base64_decode() Function Base64 Encode...

Pidgin contains a flaw that may allow a remote denial of service. The issue is triggered the 'purple_base64_decode()' function's return value is not validated properly, which may be exploited to cause a NULL pointer dereference error via crafted Base64 encoded messages, resulting in a loss of availability.

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0788.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0890.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101021_pidgin_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101116_pidgin_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2011-12-13 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_finch-111104.nasl - Type : ACT_GATHER_INFO
2011-12-13 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_finch-111105.nasl - Type : ACT_GATHER_INFO
2011-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_finch-7827.nasl - Type : ACT_GATHER_INFO
2011-05-28 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2010-305-02.nasl - Type : ACT_GATHER_INFO
2010-11-24 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0788.nasl - Type : ACT_GATHER_INFO
2010-11-18 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0890.nasl - Type : ACT_GATHER_INFO
2010-11-11 Name : The remote Fedora host is missing a security update.
File : fedora_2010-17130.nasl - Type : ACT_GATHER_INFO
2010-11-05 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1014-1.nasl - Type : ACT_GATHER_INFO
2010-11-02 Name : The remote Fedora host is missing a security update.
File : fedora_2010-16629.nasl - Type : ACT_GATHER_INFO
2010-10-30 Name : The remote Fedora host is missing a security update.
File : fedora_2010-16876.nasl - Type : ACT_GATHER_INFO
2010-10-22 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-208.nasl - Type : ACT_GATHER_INFO
2010-10-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0788.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/44283
CONFIRM http://developer.pidgin.im/viewmtn/revision/info/b01c6a1f7fe4d86b83f5f10917b3...
http://pidgin.im/news/security/?id=48
https://bugzilla.redhat.com/show_bug.cgi?id=641921
FEDORA http://lists.fedoraproject.org/pipermail/package-announce/2010-November/05022...
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/05069...
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050133...
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2010:208
OSVDB http://www.osvdb.org/68773
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT http://www.redhat.com/support/errata/RHSA-2010-0788.html
http://www.redhat.com/support/errata/RHSA-2010-0890.html
SECTRACK http://securitytracker.com/id?1024623
SECUNIA http://secunia.com/advisories/41893
http://secunia.com/advisories/41899
http://secunia.com/advisories/42075
http://secunia.com/advisories/42294
SLACKWARE http://slackware.com/security/viewer.php?l=slackware-security&y=2010&...
UBUNTU http://www.ubuntu.com/usn/USN-1014-1
VUPEN http://www.vupen.com/english/advisories/2010/2753
http://www.vupen.com/english/advisories/2010/2754
http://www.vupen.com/english/advisories/2010/2755
http://www.vupen.com/english/advisories/2010/2847
http://www.vupen.com/english/advisories/2010/2851
http://www.vupen.com/english/advisories/2010/2870
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/62708

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
Date Informations
2021-05-04 12:12:24
  • Multiple Updates
2021-04-22 01:13:15
  • Multiple Updates
2020-05-23 01:42:48
  • Multiple Updates
2020-05-23 00:26:38
  • Multiple Updates
2019-06-05 12:02:54
  • Multiple Updates
2018-09-25 12:07:41
  • Multiple Updates
2017-09-19 09:24:00
  • Multiple Updates
2017-08-17 09:23:07
  • Multiple Updates
2016-06-28 18:20:04
  • Multiple Updates
2016-04-26 20:08:56
  • Multiple Updates
2014-02-17 10:57:50
  • Multiple Updates
2013-11-04 21:21:06
  • Multiple Updates
2013-05-10 23:34:16
  • Multiple Updates