PT-2012-1149 · Pidgin+1 · Pidgin-Otr+1

Intrigeri · Published 2012-05-23 · Updated 2024-06-15 · CVE-2012-2369

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions pidgin-otr versions prior to 3.2.1

Description The issue is related to a format string vulnerability in the log message cb function in otr-plugin.c. This vulnerability might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message. The vulnerability can be exploited remotely and may lead to a breach of confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider disabling the log message cb function until a patch is available. Restrict access to the otr-plugin.c module to minimize the risk of exploitation. Avoid using format string specifiers in data that generates a log message until the issue is resolved.

Fix

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2015-09672

CVE-2012-2369

DSA-2476-1

OPENSUSE-SU-2024:10258-1

OPENSUSE-SU-2024:11173-1

SUSE-SU-2012_0703-1

Affected Products

Suse

Pidgin-Otr

References · 18

• http://openwall.com/lists/oss-security/2012/05/16/2 · Patch
• http://debian.org/security/2012/dsa-2476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2369 · Security Note
• http://security.gentoo.org/glsa/glsa-201207-05.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-2369 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2369 · Security Note
• https://bdu.fstec.ru/vul/2015-09672 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10258-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2369 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2369 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00003.html · Vendor Advisory
• https://lists.suse.com/pipermail/sle-security-updates/2012-June/000132.html · Note
• http://support.novell.com/security/cve/CVE-2012-2369.html · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://suse.com/security/cve/CVE-2012-2369 · Note