Executive Summary

Summary
Title Pidgin: Arbitrary code execution
Informations
Name GLSA-201209-17 First vendor Publication 2012-09-27
Vendor Gentoo Last vendor Modification 2012-09-27
Severity (Vendor) High Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A buffer overflow in Pidgin might allow remote attackers to execute arbitrary code or cause Denial of Service.

Background

Pidgin is a GTK Instant Messenger client for a variety of instant messaging protocols. libpurple is the core library for Pidgin.

Description

A stack-based buffer overflow vulnerability has been found in the MXit protocol plug-in for libpurple.

Impact

A remote attacker could possibly execute arbitrary code with the privileges of the Pidgin process, or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Pidgin users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/pidgin-2.10.6"

References

[ 1 ] CVE-2012-3374 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3374

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201209-17.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201209-17.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17678
 
Oval ID: oval:org.mitre.oval:def:17678
Title: Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message
Description: Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
Family: windows Class: vulnerability
Reference(s): CVE-2012-3374
 Version: 3
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Microsoft Windows 8
Microsoft Windows Server 2012
 Product(s): Pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17715
 
Oval ID: oval:org.mitre.oval:def:17715
Title: USN-1500-1 -- pidgin vulnerabilities
Description: Several security issues were fixed in Pidgin.
Family: unix Class: patch
Reference(s): USN-1500-1
CVE-2011-4601
CVE-2011-4602
CVE-2011-4603
CVE-2011-4922
CVE-2011-4939
CVE-2012-1178
CVE-2012-2214
CVE-2012-2318
CVE-2012-3374
 Version: 5
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.04
 Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18297
 
Oval ID: oval:org.mitre.oval:def:18297
Title: DSA-2509-1 pidgin - remote code execution
Description: Ulf Härnhammar found a buffer overflow in Pidgin, a multi-protocol instant messaging client. The vulnerability can be exploited by an incoming message in the MXit protocol plugin. A remote attacker may cause a crash, and in some circumstances can lead to remote code execution.
Family: unix Class: patch
Reference(s): DSA-2509-1
CVE-2012-3374
 Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20790
 
Oval ID: oval:org.mitre.oval:def:20790
Title: RHSA-2012:1102: pidgin security update (Moderate)
Description: Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
Family: unix Class: patch
Reference(s): RHSA-2012:1102-01
CESA-2012:1102
CVE-2012-1178
CVE-2012-2318
CVE-2012-3374
 Version: 42
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
 Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23185
 
Oval ID: oval:org.mitre.oval:def:23185
Title: DEPRECATED: ELSA-2012:1102: pidgin security update (Moderate)
Description: Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
Family: unix Class: patch
Reference(s): ELSA-2012:1102-01
CVE-2012-1178
CVE-2012-2318
CVE-2012-3374
 Version: 18
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23942
 
Oval ID: oval:org.mitre.oval:def:23942
Title: ELSA-2012:1102: pidgin security update (Moderate)
Description: Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
Family: unix Class: patch
Reference(s): ELSA-2012:1102-01
CVE-2012-1178
CVE-2012-2318
CVE-2012-3374
 Version: 17
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): pidgin
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27825
 
Oval ID: oval:org.mitre.oval:def:27825
Title: DEPRECATED: ELSA-2012-1102 -- pidgin security update (moderate)
Description: [2.7.9-5.el6.2] - Add patch for CVE-2011-2485 (RH bug #837561). [2.7.9-5.el6.1] - Add patch for CVE-2012-1178 (RH bug #837560). - Add patch for CVE-2012-2318 (RH bug #837560). - Add patch for CVE-2012-3374 (RH bug #837560). [2.7.9-5.el6] - Add patch for CVE-2011-4602 (RH bug #766453). [2.7.9-4.el6] - Add patch for CVE-2011-4601 (RH bug #766453).
Family: unix Class: patch
Reference(s): ELSA-2012-1102
CVE-2012-2318
CVE-2012-3374
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): pidgin
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 63

OpenVAS Exploits

Date Description
2012-10-19 Name : Pidgin MXit Message Parsing Buffer Overflow Vulnerability (Windows)
File : nvt/gb_pidgin_mxit_msg_parsing_bof_vuln_win.nasl
2012-10-03 Name : Gentoo Security Advisory GLSA 201209-17 (pidgin)
File : nvt/glsa_201209_17.nasl
2012-09-10 Name : Slackware Advisory SSA:2012-195-02 pidgin
File : nvt/esoft_slk_ssa_2012_195_02.nasl
2012-08-30 Name : Fedora Update for pidgin FEDORA-2012-10287
File : nvt/gb_fedora_2012_10287_pidgin_fc17.nasl
2012-08-10 Name : Debian Security Advisory DSA 2509-1 (pidgin)
File : nvt/deb_2509_1.nasl
2012-07-30 Name : CentOS Update for finch CESA-2012:1102 centos5
File : nvt/gb_CESA-2012_1102_finch_centos5.nasl
2012-07-30 Name : CentOS Update for finch CESA-2012:1102 centos6
File : nvt/gb_CESA-2012_1102_finch_centos6.nasl
2012-07-23 Name : RedHat Update for pidgin RHSA-2012:1102-01
File : nvt/gb_RHSA-2012_1102-01_pidgin.nasl
2012-07-16 Name : Fedora Update for pidgin FEDORA-2012-10294
File : nvt/gb_fedora_2012_10294_pidgin_fc16.nasl
2012-07-16 Name : Mandriva Update for pidgin MDVSA-2012:105 (pidgin)
File : nvt/gb_mandriva_MDVSA_2012_105.nasl
2012-07-10 Name : Ubuntu Update for pidgin USN-1500-1
File : nvt/gb_ubuntu_USN_1500_1.nasl

Nessus® Vulnerability Scanner

Date Description
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_pidgin_20130716.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1102.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_finch-120712.nasl - Type : ACT_GATHER_INFO
2012-09-28 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201209-17.nasl - Type : ACT_GATHER_INFO
2012-09-06 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-105.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120719_pidgin_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-07-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1102.nasl - Type : ACT_GATHER_INFO
2012-07-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1102.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_finch-8220.nasl - Type : ACT_GATHER_INFO
2012-07-16 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2012-195-02.nasl - Type : ACT_GATHER_INFO
2012-07-16 Name : The remote Fedora host is missing a security update.
File : fedora_2012-10294.nasl - Type : ACT_GATHER_INFO
2012-07-13 Name : An instant messaging client installed on the remote Windows host is affected ...
File : pidgin_2_10_5.nasl - Type : ACT_GATHER_INFO
2012-07-11 Name : The remote Fedora host is missing a security update.
File : fedora_2012-10287.nasl - Type : ACT_GATHER_INFO
2012-07-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1500-1.nasl - Type : ACT_GATHER_INFO
2012-07-09 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2509.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:37:35
  • Multiple Updates