Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.

From Red Hat Security Advisory 2009:1060 :

Updated pidgin packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol (XMPP). If a Pidgin client initiates a file transfer, and the remote target sends a malformed response, it could cause Pidgin to crash or, potentially, execute arbitrary code with the permissions of the user running Pidgin. This flaw only affects accounts using XMPP, such as Jabber and Google Talk. (CVE-2009-1373)

A denial of service flaw was found in Pidgin's QQ protocol decryption handler. When the QQ protocol decrypts packet information, heap data can be overwritten, possibly causing Pidgin to crash. (CVE-2009-1374)

A flaw was found in the way Pidgin's PurpleCircBuffer object is expanded. If the buffer is full when more data arrives, the data stored in this buffer becomes corrupted. This corrupted data could result in confusing or misleading data being presented to the user, or possibly crash Pidgin. (CVE-2009-1375)

It was discovered that on 32-bit platforms, the Red Hat Security Advisory RHSA-2008:0584 provided an incomplete fix for the integer overflow flaw affecting Pidgin's MSN protocol handler. If a Pidgin client receives a specially crafted MSN message, it may be possible to execute arbitrary code with the permissions of the user running Pidgin. (CVE-2009-1376)

Note: By default, when using an MSN account, only users on your buddy list can send you messages. This prevents arbitrary MSN users from exploiting this flaw.

All Pidgin users should upgrade to these updated packages, which contain backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.

From Red Hat Security Advisory 2009:1059 :

An updated pidgin package that fixes two security issues is now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol (XMPP). If a Pidgin client initiates a file transfer, and the remote target sends a malformed response, it could cause Pidgin to crash or, potentially, execute arbitrary code with the permissions of the user running Pidgin. This flaw only affects accounts using XMPP, such as Jabber and Google Talk. (CVE-2009-1373)

It was discovered that on 32-bit platforms, the Red Hat Security Advisory RHSA-2008:0584 provided an incomplete fix for the integer overflow flaw affecting Pidgin's MSN protocol handler. If a Pidgin client receives a specially crafted MSN message, it may be possible to execute arbitrary code with the permissions of the user running Pidgin. (CVE-2009-1376)

Note: By default, when using an MSN account, only users on your buddy list can send you messages. This prevents arbitrary MSN users from exploiting this flaw.

All Pidgin users should upgrade to this update package, which contains backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.

From Red Hat Security Advisory 2008:0584 :

Updated Pidgin packages that fix a security issue and address a bug are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Pidgin is a multi-protocol Internet Messaging client.

An integer overflow flaw was found in Pidgin's MSN protocol handler.
If a user received a malicious MSN message, it was possible to execute arbitrary code with the permissions of the user running Pidgin.
(CVE-2008-2927)

Note: the default Pidgin privacy setting only allows messages from users in the buddy list. This prevents arbitrary MSN users from exploiting this flaw.

This update also addresses the following bug :

* when attempting to connect to the ICQ network, Pidgin would fail to connect, present an alert saying the 'The client version you are using is too old', and de-activate the ICQ account. This update restores Pidgin's ability to connect to the ICQ network.

All Pidgin users should upgrade to these updated packages, which contain backported patches to resolve these issues.

An integer overflow flaw was found in Pidgin's MSN protocol handler.
If a user received a malicious MSN message, it was possible to execute arbitrary code with the permissions of the user running Pidgin.
(CVE-2008-2927)

Note: the default Pidgin privacy setting only allows messages from users in the buddy list. This prevents arbitrary MSN users from exploiting this flaw.

This update also addresses the following bug :

  - when attempting to connect to the ICQ network, Pidgin     would fail to connect, present an alert saying the 'The     client version you are using is too old', and     de-activate the ICQ account. This update restores     Pidgin's ability to connect to the ICQ network.

- specially crafted MSN SLP messages could cause an     integer overflow in pidgin. Attackers could potentially     exploit that to execute arbitrary code. (CVE-2008-2927)

  - overly long file names in MSN file transfers could crash     pidgin. (CVE-2008-2955)

  - SSL certifcates were not verfied. Therefore piding     didn't notice faked certificates. (CVE-2008-3532)

Additionally a problem was fixed that prevented gaim clients from connecting to the ICQ network after a server change on July 1st 2008.

Updated pidgin packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol (XMPP). If a Pidgin client initiates a file transfer, and the remote target sends a malformed response, it could cause Pidgin to crash or, potentially, execute arbitrary code with the permissions of the user running Pidgin. This flaw only affects accounts using XMPP, such as Jabber and Google Talk. (CVE-2009-1373)

A denial of service flaw was found in Pidgin's QQ protocol decryption handler. When the QQ protocol decrypts packet information, heap data can be overwritten, possibly causing Pidgin to crash. (CVE-2009-1374)

A flaw was found in the way Pidgin's PurpleCircBuffer object is expanded. If the buffer is full when more data arrives, the data stored in this buffer becomes corrupted. This corrupted data could result in confusing or misleading data being presented to the user, or possibly crash Pidgin. (CVE-2009-1375)

It was discovered that on 32-bit platforms, the Red Hat Security Advisory RHSA-2008:0584 provided an incomplete fix for the integer overflow flaw affecting Pidgin's MSN protocol handler. If a Pidgin client receives a specially crafted MSN message, it may be possible to execute arbitrary code with the permissions of the user running Pidgin. (CVE-2009-1376)

Note: By default, when using an MSN account, only users on your buddy list can send you messages. This prevents arbitrary MSN users from exploiting this flaw.

All Pidgin users should upgrade to these updated packages, which contain backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.

- specially crafted MSN SLP messages could cause an     integer overflow in pidgin. Attackers could potentially     exploit that to execute arbitrary code (CVE-2008-2927).

  - overly long file names in MSN file transfers could crash     pidgin (CVE-2008-2955).

  - SSL certifcates were not verfied. Therefore piding     didn't notice faked certificates (CVE-2008-3532)

Additionally a problem was fixed that prevented gaim clients from connecting to the ICQ network after a server change on July 1st 2008.

This is a bugfix & security fix release of Pidgin. The full ChangeLog is available at http://developer.pidgin.im/wiki/ChangeLog Details of the security fixes included are available at http://www.pidgin.im/news/security/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated pidgin package that fixes two security issues is now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol (XMPP). If a Pidgin client initiates a file transfer, and the remote target sends a malformed response, it could cause Pidgin to crash or, potentially, execute arbitrary code with the permissions of the user running Pidgin. This flaw only affects accounts using XMPP, such as Jabber and Google Talk. (CVE-2009-1373)

It was discovered that on 32-bit platforms, the Red Hat Security Advisory RHSA-2008:0584 provided an incomplete fix for the integer overflow flaw affecting Pidgin's MSN protocol handler. If a Pidgin client receives a specially crafted MSN message, it may be possible to execute arbitrary code with the permissions of the user running Pidgin. (CVE-2009-1376)

Note: By default, when using an MSN account, only users on your buddy list can send you messages. This prevents arbitrary MSN users from exploiting this flaw.

All Pidgin users should upgrade to this update package, which contains backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.

An integer overflow flaw was found in Pidgin's MSN protocol handler that could allow for the execution of arbitrary code if a user received a malicious MSN message (CVE-2008-2927).

In addition, this update provides the ability to use ICQ networks again on Mandriva Linux 2008.0, as in MDVA-2008:103 (updated pidgin for 2008.1).

The updated packages have been patched to correct this issue.

It was discovered that Gaim did not properly handle certain malformed messages in the MSN protocol handler. A remote attacker could send a specially crafted message and possibly execute arbitrary code with user privileges. (CVE-2008-2927).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Pidgin did not properly handle certain malformed messages in the MSN protocol handler. A remote attacker could send a specially crafted message and possibly execute arbitrary code with user privileges. (CVE-2008-2927)

It was discovered that Pidgin did not properly handle file transfers containing a long filename and special characters in the MSN protocol handler. A remote attacker could send a specially crafted filename in a file transfer request and cause Pidgin to crash, leading to a denial of service. (CVE-2008-2955)

It was discovered that Pidgin did not impose resource limitations in the UPnP service. A remote attacker could cause Pidgin to download arbitrary files and cause a denial of service from memory or disk space exhaustion. (CVE-2008-2957)

It was discovered that Pidgin did not validate SSL certificates when using a secure connection. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. This update alters Pidgin behaviour by asking users to confirm the validity of a certificate upon initial login.
(CVE-2008-3532).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200901-13 (Pidgin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pidgin and the     libpurple library:
    A participant to the TippingPoint ZDI reported multiple integer     overflows in the msn_slplink_process_msg() function in the MSN protocol     implementation (CVE-2008-2927).
    Juan Pablo Lopez Yacubian is credited for reporting a use-after-free     flaw in msn_slplink_process_msg() in the MSN protocol implementation     (CVE-2008-2955).
    The included UPnP server does not limit the size of data to be     downloaded for UPnP service discovery, according to a report by Andrew     Hunt and Christian Grothoff (CVE-2008-2957).
    Josh Triplett discovered that the NSS plugin for libpurple does not     properly verify SSL certificates (CVE-2008-3532).
  Impact :

    A remote attacker could send specially crafted messages or files using     the MSN protocol which could result in the execution of arbitrary code     or crash Pidgin. NOTE: Successful exploitation might require the     victim's interaction. Furthermore, an attacker could conduct     man-in-the-middle attacks to obtain sensitive information using bad     certificates and cause memory and disk resources to exhaust.
  Workaround :

    There is no known workaround at this time.

- specially crafted MSN SLP messages could cause an     integer overflow in gaim. Attackers could potentially     exploit that to execute arbitrary code (CVE-2008-2927).

Additionally a problem was fixed that prevented gaim clients from connecting to the ICQ network after a server change on July 1st 2008.

It was discovered that gaim, an multi-protocol instant messaging client, was vulnerable to several integer overflows in its MSN protocol handlers. These could allow a remote attacker to execute arbitrary code.

Updated Pidgin packages that fix a security issue and address a bug are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Pidgin is a multi-protocol Internet Messaging client.

An integer overflow flaw was found in Pidgin's MSN protocol handler.
If a user received a malicious MSN message, it was possible to execute arbitrary code with the permissions of the user running Pidgin.
(CVE-2008-2927)

Note: the default Pidgin privacy setting only allows messages from users in the buddy list. This prevents arbitrary MSN users from exploiting this flaw.

This update also addresses the following bug :

* when attempting to connect to the ICQ network, Pidgin would fail to connect, present an alert saying the 'The client version you are using is too old', and de-activate the ICQ account. This update restores Pidgin's ability to connect to the ICQ network.

All Pidgin users should upgrade to these updated packages, which contain backported patches to resolve these issues.

ID	Name	Product	Family	Severity
67863	Oracle Linux 4 : pidgin (ELSA-2009-1060)	Nessus	Oracle Linux Local Security Checks	critical
67862	Oracle Linux 3 : pidgin (ELSA-2009-1059)	Nessus	Oracle Linux Local Security Checks	high
67725	Oracle Linux 3 / 4 : pidgin (ELSA-2008-0584)	Nessus	Oracle Linux Local Security Checks	medium
60438	Scientific Linux Security Update : pidgin on SL 3.0.x , SL 4.x , SL 5.x	Nessus	Scientific Linux Local Security Checks	medium
51722	SuSE 10 Security Update : pidgin, gaim and finch (ZYPP Patch Number 5573)	Nessus	SuSE Local Security Checks	medium
43751	CentOS 4 / 5 : pidgin (CESA-2009:1060)	Nessus	CentOS Local Security Checks	critical
39959	openSUSE Security Update : finch (finch-188)	Nessus	SuSE Local Security Checks	medium
38997	Fedora 10 : pidgin-2.5.6-1.fc10 (2009-5597)	Nessus	Fedora Local Security Checks	high
38996	Fedora 11 : pidgin-2.5.6-1.fc11 (2009-5583)	Nessus	Fedora Local Security Checks	high
38995	Fedora 9 : pidgin-2.5.6-1.fc9 (2009-5552)	Nessus	Fedora Local Security Checks	high
38872	RHEL 4 / 5 : pidgin (RHSA-2009:1060)	Nessus	Red Hat Local Security Checks	critical
38871	RHEL 3 : pidgin (RHSA-2009:1059)	Nessus	Red Hat Local Security Checks	high
38868	CentOS 3 : pidgin (CESA-2009:1059)	Nessus	CentOS Local Security Checks	high
37612	Mandriva Linux Security Advisory : pidgin (MDVSA-2008:143)	Nessus	Mandriva Local Security Checks	medium
37355	Ubuntu 6.06 LTS : gaim vulnerability (USN-675-2)	Nessus	Ubuntu Local Security Checks	medium
36899	Ubuntu 7.10 / 8.04 LTS : pidgin vulnerabilities (USN-675-1)	Nessus	Ubuntu Local Security Checks	medium
35432	GLSA-200901-13 : Pidgin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
34199	openSUSE 10 Security Update : finch (finch-5592)	Nessus	SuSE Local Security Checks	medium
34192	openSUSE 10 Security Update : gaim (gaim-5421)	Nessus	SuSE Local Security Checks	medium
33508	Debian DSA-1610-1 : gaim - integer overflow	Nessus	Debian Local Security Checks	medium
33463	RHEL 3 / 4 / 5 : pidgin (RHSA-2008:0584)	Nessus	Red Hat Local Security Checks	medium
33449	CentOS 3 / 4 / 5 : pidgin (CESA-2008:0584)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2008-2927

critical

Tenable Plugins

critical

high

medium

medium

medium

critical

medium

high

high

high

critical

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium