PT-2009-1052 · Pidgin+1 · Libpurple+4

Josh Bressers · Published 2009-05-22 · Updated 2023-02-13 · CVE-2009-1373

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.5.6 libpurple versions prior to 2.5.6 libpurple-tcl versions prior to 2.5.6 libpurple-devel versions prior to 2.5.6

Description The issue involves multiple vulnerabilities in the affected software, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, a buffer overflow in the XMPP SOCKS5 bytestream server allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer.

Recommendations For Pidgin versions prior to 2.5.6, update to version 2.5.6 or later to resolve the issue. For libpurple versions prior to 2.5.6, update to version 2.5.6 or later to resolve the issue. For libpurple-tcl versions prior to 2.5.6, update to version 2.5.6 or later to resolve the issue. For libpurple-devel versions prior to 2.5.6, update to version 2.5.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the XMPP SOCKS5 bytestream server until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-06319

BDU:2015-06321

BDU:2015-06323

CVE-2009-1373

DSA-1805-1

RHSA-2009:1059

RHSA-2009:1060

RHSA-2009_1060

Affected Products

Pidgin

Red Hat

Libpurple

Libpurple-Devel

Libpurple-Tcl

References · 38

• https://bdu.fstec.ru/vul/2015-06319 · Security Note
• http://ubuntu.com/usn/USN-781-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-June/msg00075.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:140 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-1373 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06323 · Security Note
• https://bdu.fstec.ru/vul/2015-06321 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-June/msg00051.html · Vendor Advisory
• http://debian.org/security/2009/dsa-1805 · Vendor Advisory
• http://secunia.com/advisories/35194 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1373 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:173 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1059.html · Vendor Advisory
• http://securityfocus.com/bid/35067 · Patch
• http://secunia.com/advisories/35202 · Vendor Advisory