PT-2009-1009 · Psi · Psi Jabber Client

Publicado

2009-03-03

·

Atualizado

2017-09-29

·

CVE-2008-6393

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions PSI Jabber client versions prior to 0.12.1
Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option. This bypasses a signed integer check, triggering an integer overflow and a heap-based buffer overflow. Multiple vulnerabilities in the PSI package may lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.
Recommendations For PSI Jabber client versions prior to 0.12.1, update to version 0.12.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of file transfer requests until a patch is available.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2015-01927
CVE-2008-6393
DSA-1741-1

Produtos afetados

Psi Jabber Client