PT-2009-1009 · Psi · Psi Jabber Client

Published 2009-03-03 · Updated 2017-09-29 · CVE-2008-6393

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PSI Jabber client versions prior to 0.12.1

Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option. This bypasses a signed integer check, triggering an integer overflow and a heap-based buffer overflow. Multiple vulnerabilities in the PSI package may lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For PSI Jabber client versions prior to 0.12.1, update to version 0.12.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of file transfer requests until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-01927

CVE-2008-6393

DSA-1741-1

Affected Products

Psi Jabber Client

References · 21

• 🔥 http://securityfocus.com/archive/1/499563 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2009/02/25/5 · Exploit
• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=252830 · Exploit
• 🔥 https://exploit-db.com/exploits/7555 · Exploit
• https://redhat.com/archives/fedora-package-announce/2009-March/msg00071.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6393 · Security Note
• http://debian.org/security/2009/dsa-1741 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-6393 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-6393 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01927 · Security Note
• http://secunia.com/advisories/33311 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?release_id=658912 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-March/msg00080.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-6393 · Vendor Advisory