Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.64020
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2009:1060
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates to Pidgin announced in
advisory RHSA-2009:1060.

A buffer overflow flaw was found in the way Pidgin initiates file transfers
when using the Extensible Messaging and Presence Protocol (XMPP). If a
Pidgin client initiates a file transfer, and the remote target sends a
malformed response, it could cause Pidgin to crash or, potentially, execute
arbitrary code with the permissions of the user running Pidgin. This flaw
only affects accounts using XMPP, such as Jabber and Google Talk.
(CVE-2009-1373)

A denial of service flaw was found in Pidgin's QQ protocol decryption
handler. When the QQ protocol decrypts packet information, heap data can be
overwritten, possibly causing Pidgin to crash. (CVE-2009-1374)

A flaw was found in the way Pidgin's PurpleCircBuffer object is expanded.
If the buffer is full when more data arrives, the data stored in this
buffer becomes corrupted. This corrupted data could result in confusing or
misleading data being presented to the user, or possibly crash Pidgin.
(CVE-2009-1375)

It was discovered that on 32-bit platforms, the Red Hat Security Advisory
RHSA-2008:0584 provided an incomplete fix for the integer overflow flaw
affecting Pidgin's MSN protocol handler. If a Pidgin client receives a
specially-crafted MSN message, it may be possible to execute arbitrary code
with the permissions of the user running Pidgin. (CVE-2009-1376)

Note: By default, when using an MSN account, only users on your buddy list
can send you messages. This prevents arbitrary MSN users from exploiting
this flaw.

All Pidgin users should upgrade to these updated packages, which contain
backported patches to resolve these issues. Pidgin must be restarted for
this update to take effect.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2009-1060.html
http://www.redhat.com/security/updates/classification/#important

CVSS Score:
9.3

CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2009-1373
BugTraq ID: 35067
http://www.securityfocus.com/bid/35067
Debian Security Information: DSA-1805 (Google Search)
http://debian.org/security/2009/dsa-1805
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html
http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2009:140
http://www.mandriva.com/security/advisories?name=MDVSA-2009:173
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17722
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9005
http://www.redhat.com/support/errata/RHSA-2009-1059.html
http://www.redhat.com/support/errata/RHSA-2009-1060.html
http://secunia.com/advisories/35188
http://secunia.com/advisories/35194
http://secunia.com/advisories/35202
http://secunia.com/advisories/35215
http://secunia.com/advisories/35294
http://secunia.com/advisories/35329
http://secunia.com/advisories/35330
http://www.ubuntu.com/usn/USN-781-1
http://www.ubuntu.com/usn/USN-781-2
http://www.vupen.com/english/advisories/2009/1396
XForce ISS Database: pidgin-xmppsocks5-bo(50682)
https://exchange.xforce.ibmcloud.com/vulnerabilities/50682
Common Vulnerability Exposure (CVE) ID: CVE-2009-1374
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11654
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18201
XForce ISS Database: pidgin-decryptout-bo(50684)
https://exchange.xforce.ibmcloud.com/vulnerabilities/50684
Common Vulnerability Exposure (CVE) ID: CVE-2009-1375
http://osvdb.org/54649
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10829
XForce ISS Database: pidgin-purplecircbuffer-dos(50683)
https://exchange.xforce.ibmcloud.com/vulnerabilities/50683
Common Vulnerability Exposure (CVE) ID: CVE-2009-1376
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10476
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18432
http://secunia.com/advisories/37071
XForce ISS Database: pidgin-msn-slp-bo(50680)
https://exchange.xforce.ibmcloud.com/vulnerabilities/50680
Common Vulnerability Exposure (CVE) ID: CVE-2008-2927
BugTraq ID: 29956
http://www.securityfocus.com/bid/29956
Bugtraq: 20080625 Pidgin 2.4.1 Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/493682
Bugtraq: 20080806 rPSA-2008-0246-1 gaim (Google Search)
http://www.securityfocus.com/archive/1/495165/100/0/threaded
Bugtraq: 20080828 ZDI-08-054: Multiple Vendor libpurple MSN Protocol SLP Message Heap Overflow Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/495818/100/0/threaded
Debian Security Information: DSA-1610 (Google Search)
http://www.debian.org/security/2008/dsa-1610
http://www.mandriva.com/security/advisories?name=MDVSA-2008:143
http://www.mandriva.com/security/advisories?name=MDVSA-2009:127
http://www.zerodayinitiative.com/advisories/ZDI-08-054
http://www.openwall.com/lists/oss-security/2008/07/04/1
http://www.openwall.com/lists/oss-security/2008/07/03/6
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11695
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17972
http://www.redhat.com/support/errata/RHSA-2008-0584.html
http://www.securitytracker.com/id?1020451
http://secunia.com/advisories/30971
http://secunia.com/advisories/31016
http://secunia.com/advisories/31105
http://secunia.com/advisories/31387
http://secunia.com/advisories/31642
http://secunia.com/advisories/32859
http://secunia.com/advisories/32861
http://www.ubuntu.com/usn/USN-675-1
http://www.ubuntu.com/usn/USN-675-2
http://www.vupen.com/english/advisories/2008/2032/references
XForce ISS Database: adium-msnprotocol-code-execution(44774)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44774
CopyrightCopyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.