English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 75803 CVE descriptions
and 40037 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.64177
Category:Ubuntu Local Security Checks
Title:Ubuntu USN-781-1 (pidgin)
Summary:Ubuntu USN-781-1 (pidgin)
Description:The remote host is missing an update to pidgin
announced via advisory USN-781-1.

Details follow:

It was discovered that Pidgin did not properly handle certain malformed
messages when sending a file using the XMPP protocol handler. If a user
were tricked into sending a file, a remote attacker could send a specially
crafted response and cause Pidgin to crash, or possibly execute arbitrary
code with user privileges. (CVE-2009-1373)

It was discovered that Pidgin did not properly handle certain malformed
messages in the QQ protocol handler. A remote attacker could send a
specially crafted message and cause Pidgin to crash. This issue only
affected Ubuntu 8.10 and 9.04. (CVE-2009-1374)

It was discovered that Pidgin did not properly handle certain malformed
messages in the XMPP and Sametime protocol handlers. A remote attacker
could send a specially crafted message and cause Pidgin to crash.
(CVE-2009-1375)

It was discovered that Pidgin did not properly handle certain malformed
messages in the MSN protocol handler. A remote attacker could send a
specially crafted message and possibly execute arbitrary code with user
privileges. (CVE-2009-1376)

Solution:
The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
pidgin 1:2.4.1-1ubuntu2.4

Ubuntu 8.10:
pidgin 1:2.5.2-0ubuntu1.2

Ubuntu 9.04:
pidgin 1:2.5.5-1ubuntu8.1

After a standard system upgrade you need to restart Pidgin to effect
the necessary changes.

http://www.securityspace.com/smysecure/catid.html?in=USN-781-1
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2009-1373
Debian Security Information: DSA-1805 (Google Search)
http://debian.org/security/2009/dsa-1805
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html
http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2009:140
http://www.mandriva.com/security/advisories?name=MDVSA-2009:173
http://www.redhat.com/support/errata/RHSA-2009-1059.html
http://www.redhat.com/support/errata/RHSA-2009-1060.html
http://www.ubuntu.com/usn/USN-781-1
http://www.ubuntu.com/usn/USN-781-2
BugTraq ID: 35067
http://www.securityfocus.com/bid/35067
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9005
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:17722
http://secunia.com/advisories/35194
http://secunia.com/advisories/35202
http://secunia.com/advisories/35188
http://secunia.com/advisories/35215
http://secunia.com/advisories/35294
http://secunia.com/advisories/35329
http://secunia.com/advisories/35330
http://www.vupen.com/english/advisories/2009/1396
XForce ISS Database: pidgin-xmppsocks5-bo(50682)
http://xforce.iss.net/xforce/xfdb/50682
Common Vulnerability Exposure (CVE) ID: CVE-2009-1374
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11654
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:18201
XForce ISS Database: pidgin-decryptout-bo(50684)
http://xforce.iss.net/xforce/xfdb/50684
Common Vulnerability Exposure (CVE) ID: CVE-2009-1375
http://osvdb.org/54649
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10829
XForce ISS Database: pidgin-purplecircbuffer-dos(50683)
http://xforce.iss.net/xforce/xfdb/50683
Common Vulnerability Exposure (CVE) ID: CVE-2009-1376
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10476
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:18432
http://secunia.com/advisories/37071
XForce ISS Database: pidgin-msn-slp-bo(50680)
http://xforce.iss.net/xforce/xfdb/50680
CopyrightCopyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 40037 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.