PT-2011-2805 · Telepathy · Telepathy Gabble

Will Thompson · Published 2011-02-18 · Updated 2024-06-15 · CVE-2011-1000

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Telepathy Gabble versions 0.8 through 0.8.14 Telepathy Gabble versions 0.10 through 0.10.4 Telepathy Gabble versions 0.11 through 0.11.6

Description The issue allows remote attackers to intercept audio and video calls by using a crafted google:jingleinfo stanza. This stanza specifies an alternate server for streamed media, enabling the attacker to sniff the calls.

Recommendations For versions 0.8 through 0.8.14, update to version 0.8.15 or later. For versions 0.10 through 0.10.4, update to version 0.10.5 or later. For versions 0.11 through 0.11.6, update to version 0.11.7 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-1000

DSA-2169-1

OPENSUSE-SU-2024:10079-1

Affected Products

Telepathy Gabble

References · 26

• https://hermes.opensuse.org/messages/7848248 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/02/17/4 · Patch
• http://openwall.com/lists/oss-security/2011/02/17/7 · Patch
• https://bugs.freedesktop.org/show_bug.cgi?id=34048 · Patch
• http://ubuntu.com/usn/USN-1067-1 · Vendor Advisory
• http://secunia.com/advisories/43404 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054324.html · Vendor Advisory
• http://secunia.com/advisories/43316 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054409.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10079-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054575.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1000 · Security Note
• http://vupen.com/english/advisories/2011/0412 · Vendor Advisory
• http://secunia.com/advisories/43369 · Vendor Advisory