PT-2008-1057 · Pidgin+2 · Libpurple+4

Published 2008-08-08 · Updated 2024-06-15 · CVE-2008-3532

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libpurple versions 2.4.3 through 2.5.2 libpurple-devel versions 2.5.2 libpurple-tcl versions 2.5.2

Description The issue is related to multiple vulnerabilities in the libpurple package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, the NSS plugin in libpurple does not verify SSL certificates, making it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.

Recommendations For libpurple versions 2.4.3 through 2.5.2, consider disabling the SSL verification function until a patch is available. For libpurple-devel versions 2.5.2, restrict access to the vulnerable package to minimize the risk of exploitation. For libpurple-tcl versions 2.5.2, avoid using the vulnerable package in production environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

CWE-310

Related Identifiers

BDU:2015-06318

BDU:2015-06320

BDU:2015-06322

CVE-2008-3532

OPENSUSE-SU-2024:11172-1

RHSA-2008:1023

RHSA-2008_1023

Affected Products

Nss

Red Hat

Libpurple

Libpurple-Devel

Libpurple-Tcl

References · 33

• 🔥 http://developer.pidgin.im/attachment/ticket/6500/nss-cert-verify.patch · Exploit
• https://bdu.fstec.ru/vul/2015-06322 · Security Note
• https://bdu.fstec.ru/vul/2015-06320 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:025 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06318 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11172-1 · Vendor Advisory
• http://developer.pidgin.im/ticket/6500 · Patch
• http://redhat.com/support/errata/RHSA-2008-1023.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-3532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3532 · Security Note
• http://ubuntu.com/usn/USN-675-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-3532 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3532 · Vendor Advisory
• https://suse.com/security/cve/CVE-2008-3532 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2008-493.htm · Note