PT-2010-1150 · Pidgin · Pidgin-Knotify Plugin

Matthias Petschick · Published 2010-10-08 · Updated 2014-02-26 · CVE-2010-3088

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pidgin-knotify plugin versions 0.2.1 and earlier

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a message, potentially leading to a breach of confidentiality, integrity, and availability of protected information. This can be exploited remotely.

Recommendations For Pidgin-knotify plugin versions 0.2.1 and earlier, consider disabling the notify function in pidgin-knotify.c as a temporary workaround until a patch is available. Restrict access to the pidgin-knotify plugin to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2015-09694

CVE-2010-3088

Affected Products

Pidgin-Knotify Plugin

References · 7

• https://bdu.fstec.ru/vul/2015-09694 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-3088 · Security Note
• http://security.gentoo.org/glsa/glsa-201402-27.xml · Note
• https://bugs.gentoo.org/show_bug.cgi?id=336916 · Note
• http://code.google.com/p/pidgin-knotify/issues/detail?id=1 · Note
• http://openwall.com/lists/oss-security/2010/09/12/1 · Note
• http://openwall.com/lists/oss-security/2010/09/13/4 · Note