Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

From Red Hat Security Advisory 2010:0044 :

Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A directory traversal flaw was discovered in Pidgin's MSN protocol implementation. A remote attacker could send a specially crafted emoticon image download request that would cause Pidgin to disclose an arbitrary file readable to the user running Pidgin. (CVE-2010-0013)

These packages upgrade Pidgin to version 2.6.5. Refer to the Pidgin release notes for a full list of changes:
http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users should upgrade to these updated packages, which correct this issue. Pidgin must be restarted for this update to take effect.

A directory traversal flaw was discovered in Pidgin's MSN protocol implementation. A remote attacker could send a specially crafted emoticon image download request that would cause Pidgin to disclose an arbitrary file readable to the user running Pidgin. (CVE-2010-0013)

These packages upgrade Pidgin to version 2.6.5.

Pidgin must be restarted for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201206-11 (Pidgin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pidgin. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities allow for arbitrary file retrieval, Denial of       Service and arbitrary code execution with the privileges of the user       running Pidgin.
  Workaround :

    There is no known workaround at this time.

This update of pidgin fixes various security vulnerabilities :

  - Remote file disclosure vulnerability by using the MSN     protocol. CVE-2010-0277: CVSS v2 Base Score: 4.9:
    Resource Management Errors (CWE-399) MSN protocol plugin     in libpurple allowed remote attackers to cause a denial     of service (memory corruption) at least. CVE-2010-0420:
    Same nick names in XMPP MUC lead to a crash in finch.
    CVE-2010-0423: A remote denial of service attack     (resource consumption) is possible by sending an IM with     a lot of smilies in it. (CVE-2010-0013: CVSS v2 Base     Score: 4.3: Path Traversal (CWE-22))

New release 2.7.5

Full Upstream ChangeLog :

  -     http://developer.pidgin.im/wiki/ChangeLog#version2.7.410     202010

    -       http://developer.pidgin.im/wiki/ChangeLog#version2.7.5       10312010

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New release to address a security issue and a couple of bugfixes Details at http://developer.pidgin.im/wiki/ChangeLog

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A security vulnerability has been identified and fixed in pidgin :

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon (CVE-2010-0013).

This update provides pidgin 2.6.5, which is not vulnerable to this issue.

2.7.0 with new features, bug fixes and a security fix for CVE-2010-1624 Full Upstream ChangeLog: * http://developer.pidgin.im/wiki/ChangeLog Fedora packaging changes: * Use System SSL Certificates * Add additional dependencies for Voice + Video

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

2.6.6 with security and numerous minor bug fixes CVE-2010-0277 CVE-2010-0420 CVE-2010-0423

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2010-0013 - A few other bug fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security vulnerabilities has been identified and fixed in pidgin :

The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client (CVE-2009-3615).

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon (CVE-2010-0013).

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon (CVE-2010-0013).

Certain malformed SLP messages can trigger a crash because the MSN protocol plugin fails to check that all pieces of the message are set correctly (CVE-2010-0277).

In a user in a multi-user chat room has a nickname containing '<br>' then libpurple ends up having two users with username ' ' in the room, and Finch crashes in this situation. We do not believe there is a possibility of remote code execution (CVE-2010-0420).

oCERT notified us about a problem in Pidgin, where a large amount of processing time will be used when inserting many smileys into an IM or chat window. This should not cause a crash, but Pidgin can become unusable slow (CVE-2010-0423).

Packages for 2009.0 are provided due to the Extended Maintenance Program.

This update provides pidgin 2.6.6, which is not vulnerable to these issues.

This update of pidgin fixes various security vulnerabilities

  - CVE-2010-0013: CVSS v2 Base Score: 4.3: Path Traversal     (CWE-22) Remote file disclosure vulnerability by using     the MSN protocol.

  - CVE-2010-0277: CVSS v2 Base Score: 4.9: Resource     Management Errors (CWE-399) MSN protocol plugin in     libpurple allowed remote attackers to cause a denial of     service (memory corruption) at least.

  - CVE-2010-0420 Same nick names in XMPP MUC lead to a     crash in finch.

  - CVE-2010-0423 A remote denial of service attack     (resource consumption) is possible by sending an IM with     a lot of smilies in it.

This update of pidgin fixes various security vulnerabilities :

  - Remote file disclosure vulnerability by using the MSN     protocol. (CVE-2010-0013: CVSS v2 Base Score: 4.3 : Path     Traversal (CWE-22))

  - MSN protocol plugin in libpurple allowed remote     attackers to cause a denial of service (memory     corruption) at least. (CVE-2010-0277: CVSS v2 Base     Score: 4.9 : Resource Management Errors (CWE-399))

  - Same nick names in XMPP MUC lead to a crash in finch.
    (CVE-2010-0420)

  - A remote denial of service attack (resource consumption)     is possible by sending an IM with a lot of smilies in     it. (CVE-2010-0423)

New pidgin packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix a security issue.

It was discovered that Pidgin did not properly handle certain topic messages in the IRC protocol handler. If a user were tricked into connecting to a malicious IRC server, an attacker could cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-2703)

It was discovered that Pidgin did not properly enforce the 'require TLS/SSL' setting when connecting to certain older Jabber servers. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. This issue only affected Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-3026)

It was discovered that Pidgin did not properly handle certain SLP invite messages in the MSN protocol handler. A remote attacker could send a specially crafted invite message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-3083)

It was discovered that Pidgin did not properly handle certain errors in the XMPP protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.10 and Ubuntu 9.04.
(CVE-2009-3085)

It was discovered that Pidgin did not properly handle malformed contact-list data in the OSCAR protocol handler. A remote attacker could send specially crafted contact-list data and cause Pidgin to crash, leading to a denial of service. (CVE-2009-3615)

It was discovered that Pidgin did not properly handle custom smiley requests in the MSN protocol handler. A remote attacker could send a specially crafted filename in a custom smiley request and obtain arbitrary files via directory traversal. This issue only affected Ubuntu 8.10, Ubuntu 9.04 and Ubuntu 9.10. (CVE-2010-0013)

Pidgin for Ubuntu 8.04 LTS was also updated to fix connection issues with the MSN protocol.

USN-675-1 and USN-781-1 provided updated Pidgin packages to fix multiple security vulnerabilities in Ubuntu 8.04 LTS. The security patches to fix CVE-2008-2955 and CVE-2009-1376 were incomplete. This update corrects the problem. 

It was discovered that Pidgin did not properly handle file transfers containing a long filename and special characters in the MSN protocol handler. A remote attacker could send a specially crafted filename in a file transfer request and cause Pidgin to crash, leading to a denial of service. (CVE-2008-2955)

It was discovered that Pidgin did not properly handle certain malformed messages in the MSN protocol handler. A remote attacker could send a specially crafted message and possibly execute arbitrary code with user privileges.
(CVE-2009-1376).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:0044 advisory.

    Pidgin is an instant messaging program which can log in to multiple     accounts on multiple instant messaging networks simultaneously.

    A directory traversal flaw was discovered in Pidgin's MSN protocol     implementation. A remote attacker could send a specially-crafted emoticon     image download request that would cause Pidgin to disclose an arbitrary     file readable to the user running Pidgin. (CVE-2010-0013)

    These packages upgrade Pidgin to version 2.6.5. Refer to the Pidgin release     notes for a full list of changes: http://developer.pidgin.im/wiki/ChangeLog

    All Pidgin users should upgrade to these updated packages, which correct     this issue. Pidgin must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

A directory traversal flaw was discovered in Pidgin's MSN protocol implementation. A remote attacker could send a specially crafted emoticon image download request that would cause Pidgin to disclose an arbitrary file readable to the user running Pidgin. (CVE-2010-0013)

These packages upgrade Pidgin to version 2.6.5. Refer to the Pidgin release notes for a full list of changes:
http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users should upgrade to these updated packages, which correct this issue. Pidgin must be restarted for this update to take effect.

The remote host is running Pidgin < 2.6.5.  Such versions are potentially affected by an information disclosure vulnerability because the MSN protocol plugin axtracts the filename of a custom emoticon from an incoming request and uploads that file without correlating the filename to a valid custom emoticon.

The version of Pidgin installed on the remote host is earlier than 2.6.5.  Such versions have a directory traversal vulnerability when processing an MSN emoticon request.  A remote attacker could exploit this to read arbitrary files.

Security vulnerabilities has been identified and fixed in pidgin :

The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client (CVE-2009-3615).

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon (CVE-2010-0013).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

This update provides pidgin 2.6.5, which is not vulnerable to these issues.

ID	Name	Product	Family	Severity
67987	Oracle Linux 4 : pidgin (ELSA-2010-0044)	Nessus	Oracle Linux Local Security Checks	medium
60724	Scientific Linux Security Update : pidgin on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59649	GLSA-201206-11 : Pidgin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
51728	SuSE 10 Security Update : pidgin (ZYPP Patch Number 6861)	Nessus	SuSE Local Security Checks	medium
51727	SuSE 10 Security Update : pidgin (ZYPP Patch Number 6856)	Nessus	SuSE Local Security Checks	medium
50556	Fedora 12 : pidgin-2.7.5-1.fc12 (2010-17130)	Nessus	Fedora Local Security Checks	medium
48206	Fedora 12 : pidgin-2.7.2-1.fc12 (2010-11315)	Nessus	Fedora Local Security Checks	medium
48164	Mandriva Linux Security Advisory : pidgin (MDVSA-2010:002)	Nessus	Mandriva Local Security Checks	medium
47496	Fedora 12 : pidgin-2.7.0-2.fc12 (2010-8524)	Nessus	Fedora Local Security Checks	medium
47495	Fedora 11 : pidgin-2.7.0-2.fc11 (2010-8523)	Nessus	Fedora Local Security Checks	critical
47252	Fedora 12 : pidgin-2.6.6-1.fc12 (2010-1383)	Nessus	Fedora Local Security Checks	medium
47244	Fedora 11 : pidgin-2.6.6-1.fc11 (2010-1279)	Nessus	Fedora Local Security Checks	critical
47184	Fedora 11 : pidgin-2.6.5-1.fc11 (2010-0429)	Nessus	Fedora Local Security Checks	critical
47181	Fedora 12 : pidgin-2.6.5-1.fc12 (2010-0368)	Nessus	Fedora Local Security Checks	medium
46177	Mandriva Linux Security Advisory : pidgin (MDVSA-2010:085)	Nessus	Mandriva Local Security Checks	medium
44982	openSUSE Security Update : finch (finch-2032)	Nessus	SuSE Local Security Checks	medium
44979	openSUSE Security Update : finch (finch-2032)	Nessus	SuSE Local Security Checks	medium
44976	openSUSE Security Update : finch (finch-2032)	Nessus	SuSE Local Security Checks	medium
44965	SuSE 11 Security Update : pidgin (SAT Patch Number 2019)	Nessus	SuSE Local Security Checks	medium
44122	Slackware 12.0 / 12.1 / 12.2 / 13.0 / current : pidgin (SSA:2010-024-03)	Nessus	Slackware Local Security Checks	medium
44057	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : pidgin vulnerabilities (USN-886-1)	Nessus	Ubuntu Local Security Checks	critical
44030	RHEL 4 / 5 : pidgin (RHSA-2010:0044)	Nessus	Red Hat Local Security Checks	high
44028	CentOS 4 / 5 : pidgin (CESA-2010:0044)	Nessus	CentOS Local Security Checks	medium
5298	Pidgin < 2.6.5 Information Disclosure Vulnerability	Nessus Network Monitor	Internet Messengers	medium
43862	Pidgin MSN Custom Smileys Feature Emoticon Request Traversal Arbitrary File Disclosure	Nessus	Windows	medium
43853	Mandriva Linux Security Advisory : pidgin (MDVSA-2010:001)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-0013

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

critical

high

medium

medium

medium

medium