PT-2019-6748 · Pidgin+1 · Pidgin+1

Published 2019-11-20 · Updated 2019-11-21 · CVE-2012-1257

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pidgin version 2.10.0

Description The issue allows local users to obtain sensitive information via a dbus session monitor, as Pidgin 2.10.0 uses DBUS for certain cleartext communication.

Recommendations For Pidgin version 2.10.0, consider restricting access to the DBUS interface to minimize the risk of exploitation. As a temporary workaround, avoid using cleartext communication via DBUS until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2012-1257

Affected Products

Debian

Pidgin

References · 14

• 🔥 https://exploit-db.com/exploits/36884 · Exploit
• https://ubuntu.com/security/CVE-2012-1257 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/pidgin · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-1257 · Vendor Advisory
• http://pidgin.im/pipermail/devel/2011-December/010521.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1257 · Security Note
• https://osv.dev/vulnerability/CVE-2012-1257 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1257 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-1257 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1257 · Vendor Advisory
• http://developer.pidgin.im/ticket/14830 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-1257 · Security Note
• http://seclists.org/fulldisclosure/2012/Feb/414 · Note
• https://packages.debian.org/src:pidgin · Note