PT-2009-1018 · Pidgin+1 · Libpurple+1
Federico Muttis
·
Publicado
2009-08-18
·
Atualizado
2017-09-19
·
CVE-2009-2694
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libpurple versions 2.5.9 and earlier
Description
The issue is related to the
msn slplink process msg function in libpurple, which allows remote attackers to execute arbitrary code or cause a denial of service by sending multiple crafted SLP messages. This can lead to memory corruption and application crash, compromising the confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely.Recommendations
For libpurple versions 2.5.9 and earlier, consider updating to a version later than 2.5.9 to resolve the issue. As a temporary workaround, restrict the use of the
msn slplink process msg function until a patch is available. Additionally, be cautious when receiving SLP messages to minimize the risk of exploitation.Exploit
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Libpurple