Executive Summary
| Summary | |
|---|---|
| Title | Pidgin vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-1014-1 | First vendor Publication | 2010-11-04 |
| Vendor | Ubuntu | Last vendor Modification | 2010-11-04 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 8.04 LTS Ubuntu 9.10 Ubuntu 10.04 LTS Ubuntu 10.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.04 LTS: Ubuntu 9.10: Ubuntu 10.04 LTS: Ubuntu 10.10: After a standard system update you need to restart Pidgin to make all the necessary changes. Details follow: Pierre Noguès discovered that Pidgin incorrectly handled malformed SLP messages in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-1624) Daniel Atallah discovered that Pidgin incorrectly handled the return code of the Base64 decoding function. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. (CVE-2010-3711) |
Original Source
| Url : http://www.ubuntu.com/usn/USN-1014-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12998 | |||
| Oval ID: | oval:org.mitre.oval:def:12998 | ||
| Title: | USN-1014-1 -- pidgin vulnerabilities | ||
| Description: | Pierre Noguès discovered that Pidgin incorrectly handled malformed SLP messages in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. Daniel Atallah discovered that Pidgin incorrectly handled the return code of the Base64 decoding function. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1014-1 CVE-2010-1624 CVE-2010-3711 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18506 | |||
| Oval ID: | oval:org.mitre.oval:def:18506 | ||
| Title: | libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support | ||
| Description: | libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3711 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Pidgin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:18547 | |||
| Oval ID: | oval:org.mitre.oval:def:18547 | ||
| Title: | The msn_emoticon_msg function in slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.7.0 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a custom emoticon in a malformed SLP message | ||
| Description: | The msn_emoticon_msg function in slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.7.0 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a custom emoticon in a malformed SLP message. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-1624 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Pidgin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22271 | |||
| Oval ID: | oval:org.mitre.oval:def:22271 | ||
| Title: | RHSA-2010:0788: pidgin security update (Moderate) | ||
| Description: | libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2010:0788-01 CESA-2010:0788 CVE-2010-1624 CVE-2010-3711 | Version: | 29 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22323 | |||
| Oval ID: | oval:org.mitre.oval:def:22323 | ||
| Title: | RHSA-2010:0890: pidgin security update (Moderate) | ||
| Description: | libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2010:0890-01 CVE-2010-3711 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22964 | |||
| Oval ID: | oval:org.mitre.oval:def:22964 | ||
| Title: | ELSA-2010:0788: pidgin security update (Moderate) | ||
| Description: | libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2010:0788-01 CVE-2010-1624 CVE-2010-3711 | Version: | 13 |
| Platform(s): | Oracle Linux 5 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:23485 | |||
| Oval ID: | oval:org.mitre.oval:def:23485 | ||
| Title: | ELSA-2010:0890: pidgin security update (Moderate) | ||
| Description: | libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2010:0890-01 CVE-2010-3711 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27802 | |||
| Oval ID: | oval:org.mitre.oval:def:27802 | ||
| Title: | DEPRECATED: ELSA-2010-0890 -- pidgin security update (moderate) | ||
| Description: | [2.6.6-6.el6] - Add patch for CVE-2010-3711 (RH bug #645413). | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2010-0890 CVE-2010-3711 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | pidgin |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-09-12 | Name : Fedora Update for pidgin FEDORA-2011-11595 File : nvt/gb_fedora_2011_11595_pidgin_fc14.nasl |
| 2011-08-09 | Name : CentOS Update for finch CESA-2010:0788 centos5 i386 File : nvt/gb_CESA-2010_0788_finch_centos5_i386.nasl |
| 2011-07-18 | Name : Fedora Update for pidgin FEDORA-2011-8917 File : nvt/gb_fedora_2011_8917_pidgin_fc14.nasl |
| 2011-03-24 | Name : Fedora Update for pidgin FEDORA-2011-3132 File : nvt/gb_fedora_2011_3132_pidgin_fc13.nasl |
| 2011-03-24 | Name : Fedora Update for pidgin FEDORA-2011-3113 File : nvt/gb_fedora_2011_3113_pidgin_fc14.nasl |
| 2011-01-11 | Name : Fedora Update for pidgin FEDORA-2010-19317 File : nvt/gb_fedora_2010_19317_pidgin_fc13.nasl |
| 2011-01-11 | Name : Fedora Update for pidgin FEDORA-2010-19314 File : nvt/gb_fedora_2010_19314_pidgin_fc14.nasl |
| 2010-12-02 | Name : Fedora Update for pidgin FEDORA-2010-16876 File : nvt/gb_fedora_2010_16876_pidgin_fc14.nasl |
| 2010-11-16 | Name : Ubuntu Update for pidgin vulnerabilities USN-1014-1 File : nvt/gb_ubuntu_USN_1014_1.nasl |
| 2010-11-16 | Name : Fedora Update for pidgin FEDORA-2010-17130 File : nvt/gb_fedora_2010_17130_pidgin_fc12.nasl |
| 2010-11-16 | Name : Fedora Update for pidgin FEDORA-2010-16629 File : nvt/gb_fedora_2010_16629_pidgin_fc13.nasl |
| 2010-11-04 | Name : CentOS Update for finch CESA-2010:0788 centos4 i386 File : nvt/gb_CESA-2010_0788_finch_centos4_i386.nasl |
| 2010-11-04 | Name : Pidgin Libpurple 'purple_base64_decode()' Denial of Service Vulnerabilities (... File : nvt/gb_pidgin_libpurple_mult_dos_vuln_win.nasl |
| 2010-10-22 | Name : RedHat Update for pidgin RHSA-2010:0788-01 File : nvt/gb_RHSA-2010_0788-01_pidgin.nasl |
| 2010-10-22 | Name : Mandriva Update for pidgin MDVSA-2010:208 (pidgin) File : nvt/gb_mandriva_MDVSA_2010_208.nasl |
| 2010-08-02 | Name : Fedora Update for pidgin FEDORA-2010-11315 File : nvt/gb_fedora_2010_11315_pidgin_fc12.nasl |
| 2010-07-30 | Name : Fedora Update for pidgin FEDORA-2010-11321 File : nvt/gb_fedora_2010_11321_pidgin_fc13.nasl |
| 2010-05-28 | Name : Fedora Update for pidgin FEDORA-2010-8523 File : nvt/gb_fedora_2010_8523_pidgin_fc11.nasl |
| 2010-05-28 | Name : Fedora Update for pidgin FEDORA-2010-8524 File : nvt/gb_fedora_2010_8524_pidgin_fc12.nasl |
| 2010-05-28 | Name : Mandriva Update for pidgin MDVSA-2010:097 (pidgin) File : nvt/gb_mandriva_MDVSA_2010_097.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2010-305-02 pidgin File : nvt/esoft_slk_ssa_2010_305_02.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2010-138-01 pidgin File : nvt/esoft_slk_ssa_2010_138_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 68773 | Pidgin Multiple Protocol Plugin purple_base64_decode() Function Base64 Encode... Pidgin contains a flaw that may allow a remote denial of service. The issue is triggered the 'purple_base64_decode()' function's return value is not validated properly, which may be exploited to cause a NULL pointer dereference error via crafted Base64 encoded messages, resulting in a loss of availability. |
| 64609 | Pidgin libpurple slp.c msn_emoticon_msg Function SLP Message Custom Emoticon DoS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-12-28 | Name : The remote host is missing Sun Security Patch number 143318-03 File : solaris10_x86_143318.nasl - Type : ACT_GATHER_INFO |
| 2013-12-28 | Name : The remote host is missing Sun Security Patch number 143317-03 File : solaris10_143317.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0890.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0788.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20101116_pidgin_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20101021_pidgin_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2011-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_finch-7827.nasl - Type : ACT_GATHER_INFO |
| 2011-12-13 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_finch-111105.nasl - Type : ACT_GATHER_INFO |
| 2011-12-13 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_finch-111104.nasl - Type : ACT_GATHER_INFO |
| 2011-05-28 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2010-305-02.nasl - Type : ACT_GATHER_INFO |
| 2010-11-24 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0788.nasl - Type : ACT_GATHER_INFO |
| 2010-11-18 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0890.nasl - Type : ACT_GATHER_INFO |
| 2010-11-11 | Name : The remote Fedora host is missing a security update. File : fedora_2010-17130.nasl - Type : ACT_GATHER_INFO |
| 2010-11-05 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1014-1.nasl - Type : ACT_GATHER_INFO |
| 2010-11-02 | Name : The remote Fedora host is missing a security update. File : fedora_2010-16629.nasl - Type : ACT_GATHER_INFO |
| 2010-10-30 | Name : The remote Fedora host is missing a security update. File : fedora_2010-16876.nasl - Type : ACT_GATHER_INFO |
| 2010-10-22 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-208.nasl - Type : ACT_GATHER_INFO |
| 2010-10-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0788.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-8524.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-8523.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-8503.nasl - Type : ACT_GATHER_INFO |
| 2010-05-19 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-097.nasl - Type : ACT_GATHER_INFO |
| 2010-05-19 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2010-138-01.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:58:03 |
|
