PT-2009-1064 · Libpurple+2 · Libpurple+4

Jan Lieskovsky · Published 2009-07-01 · Updated 2017-09-29 · CVE-2009-1889

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Pidgin versions prior to 2.5.8 libpurple-devel versions prior to 2.5.8 libpurple-tcl versions prior to 2.5.8 libpurple versions prior to 2.5.8

Description The issue is related to the misinterpretation of the ICQWebMessage message type as the ICQSMS message type in the OSCAR protocol implementation. This can be exploited by remote attackers to cause a denial of service, specifically an application crash, by sending a crafted ICQ web message that triggers the allocation of a large amount of memory. The exploitation can be done remotely and may lead to disruption of protected information availability.

Recommendations For Pidgin versions prior to 2.5.8, update to version 2.5.8 or later to resolve the issue. For libpurple-devel versions prior to 2.5.8, update to version 2.5.8 or later to resolve the issue. For libpurple-tcl versions prior to 2.5.8, update to version 2.5.8 or later to resolve the issue. For libpurple versions prior to 2.5.8, update to version 2.5.8 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-07028

BDU:2015-07030

BDU:2015-07032

CVE-2009-1889

RHSA-2009:1139

RHSA-2009_1139

Affected Products

Pidgin

Red Hat

Libpurple

Libpurple-Devel

Libpurple-Tcl

References · 26

• http://developer.pidgin.im/ticket/9483 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07030 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-1889 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1889 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-July/msg00176.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-July/msg00162.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1889 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-July/msg00228.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07032 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1889 · Security Note
• https://bdu.fstec.ru/vul/2015-07028 · Security Note
• http://pidgin.im/pipermail/devel/2009-May/008227.html · Patch
• http://ubuntu.com/usn/USN-796-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1139.html · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2009-1889 · Note