PT-2009-1055 · Libpurple+2 · Libpurple+2

Josh Bressers

·

Published

2009-05-22

·

Updated

2023-02-13

·

CVE-2009-1376

CVSS v2.0

9.3

High

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.5.6 libpurple versions prior to 2.5.6
Description The issue is caused by multiple integer overflows in the MSN protocol handler, allowing remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, leading to buffer overflows. This can result in disruption of confidentiality, integrity, and availability of protected information. The exploitation of these vulnerabilities can be done remotely.
Recommendations For Pidgin versions prior to 2.5.6, update to version 2.5.6 or later to resolve the issue. For libpurple versions prior to 2.5.6, update to version 2.5.6 or later to resolve the issue. As a temporary workaround, consider disabling the MSN protocol handler until a patch is available.

Exploit

Fix

RCE

Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-119CWE-189

Related Identifiers

BDU:2015-06319
BDU:2015-06321
BDU:2015-06323
CVE-2009-1376
DSA-1805-1
RHSA-2009:1059
RHSA-2009:1060
RHSA-2009_1060

Affected Products

Pidgin
Red Hat
Libpurple