libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing <br> sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.

From Red Hat Security Advisory 2010:0115 :

Updated pidgin packages that fix three security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

An input sanitization flaw was found in the way Pidgin's MSN protocol implementation handled MSNSLP invitations. A remote attacker could send a specially crafted INVITE request that would cause a denial of service (memory corruption and Pidgin crash). (CVE-2010-0277)

A denial of service flaw was found in Finch's XMPP chat implementation, when using multi-user chat. If a Finch user in a multi-user chat session were to change their nickname to contain the HTML 'br' element, it would cause Finch to crash. (CVE-2010-0420)

Red Hat would like to thank Sadrul Habib Chowdhury of the Pidgin project for responsibly reporting the CVE-2010-0420 issue.

A denial of service flaw was found in the way Pidgin processed emoticon images. A remote attacker could flood the victim with emoticon images during mutual communication, leading to excessive CPU use. (CVE-2010-0423)

These packages upgrade Pidgin to version 2.6.6. Refer to the Pidgin release notes for a full list of changes:
http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users are advised to upgrade to these updated packages, which correct these issues. Pidgin must be restarted for this update to take effect.

CVE-2010-0277 pidgin MSN protocol plugin memory corruption

CVE-2010-0420 pidgin: Finch XMPP MUC Crash

CVE-2010-0423 pidgin: Smiley Denial of Service

An input sanitization flaw was found in the way Pidgin's MSN protocol implementation handled MSNSLP invitations. A remote attacker could send a specially crafted INVITE request that would cause a denial of service (memory corruption and Pidgin crash). (CVE-2010-0277)

A denial of service flaw was found in Finch's XMPP chat implementation, when using multi-user chat. If a Finch user in a multi-user chat session were to change their nickname to contain the HTML 'br' element, it would cause Finch to crash. (CVE-2010-0420)

A denial of service flaw was found in the way Pidgin processed emoticon images. A remote attacker could flood the victim with emoticon images during mutual communication, leading to excessive CPU use. (CVE-2010-0423)

Pidgin must be restarted for this update to take effect.

This update of pidgin fixes various security vulnerabilities :

  - Remote file disclosure vulnerability by using the MSN     protocol. CVE-2010-0277: CVSS v2 Base Score: 4.9:
    Resource Management Errors (CWE-399) MSN protocol plugin     in libpurple allowed remote attackers to cause a denial     of service (memory corruption) at least. CVE-2010-0420:
    Same nick names in XMPP MUC lead to a crash in finch.
    CVE-2010-0423: A remote denial of service attack     (resource consumption) is possible by sending an IM with     a lot of smilies in it. (CVE-2010-0013: CVSS v2 Base     Score: 4.3: Path Traversal (CWE-22))

2.6.6 with security and numerous minor bug fixes CVE-2010-0277 CVE-2010-0420 CVE-2010-0423

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security vulnerabilities has been identified and fixed in pidgin :

The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client (CVE-2009-3615).

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon (CVE-2010-0013).

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon (CVE-2010-0013).

Certain malformed SLP messages can trigger a crash because the MSN protocol plugin fails to check that all pieces of the message are set correctly (CVE-2010-0277).

In a user in a multi-user chat room has a nickname containing '<br>' then libpurple ends up having two users with username ' ' in the room, and Finch crashes in this situation. We do not believe there is a possibility of remote code execution (CVE-2010-0420).

oCERT notified us about a problem in Pidgin, where a large amount of processing time will be used when inserting many smileys into an IM or chat window. This should not cause a crash, but Pidgin can become unusable slow (CVE-2010-0423).

Packages for 2009.0 are provided due to the Extended Maintenance Program.

This update provides pidgin 2.6.6, which is not vulnerable to these issues.

Three denial of service vulnerabilities where found in pidgin and allow remote attackers to crash the application. The developers summarized these problems as follows :

Pidgin can become unresponsive when displaying large numbers of smileys

Certain nicknames in group chat rooms can trigger a crash in Finch

Failure to validate all fields of an incoming message can trigger a crash

Several remote vulnerabilities have been discovered in Pidgin, a multi protocol instant messaging client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-0420     Crafted nicknames in the XMPP protocol can crash Pidgin     remotely.

  - CVE-2010-0423     Remote contacts may send too many custom smilies,     crashing Pidgin.

Since a few months, Microsoft's servers for MSN have changed the protocol, making Pidgin non-functional for use with MSN. It is not feasible to port these changes to the version of Pidgin in Debian Lenny. This update formalises that situation by disabling the protocol in the client. Users of the MSN protocol are advised to use the version of Pidgin in the repositories of www.backports.org.

New pidgin packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix denial of service issues.

This update of pidgin fixes various security vulnerabilities

  - CVE-2010-0013: CVSS v2 Base Score: 4.3: Path Traversal     (CWE-22) Remote file disclosure vulnerability by using     the MSN protocol.

  - CVE-2010-0277: CVSS v2 Base Score: 4.9: Resource     Management Errors (CWE-399) MSN protocol plugin in     libpurple allowed remote attackers to cause a denial of     service (memory corruption) at least.

  - CVE-2010-0420 Same nick names in XMPP MUC lead to a     crash in finch.

  - CVE-2010-0423 A remote denial of service attack     (resource consumption) is possible by sending an IM with     a lot of smilies in it.

This update of pidgin fixes various security vulnerabilities :

  - Remote file disclosure vulnerability by using the MSN     protocol. (CVE-2010-0013: CVSS v2 Base Score: 4.3 : Path     Traversal (CWE-22))

  - MSN protocol plugin in libpurple allowed remote     attackers to cause a denial of service (memory     corruption) at least. (CVE-2010-0277: CVSS v2 Base     Score: 4.9 : Resource Management Errors (CWE-399))

  - Same nick names in XMPP MUC lead to a crash in finch.
    (CVE-2010-0420)

  - A remote denial of service attack (resource consumption)     is possible by sending an IM with a lot of smilies in     it. (CVE-2010-0423)

Fabian Yamaguchi discovered that Pidgin incorrectly validated all fields of an incoming message in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. (CVE-2010-0277)

Sadrul Habib Chowdhury discovered that Pidgin incorrectly handled certain nicknames in Finch group chat rooms. A remote attacker could use a specially crafted nickname and cause Pidgin to crash, leading to a denial of service. (CVE-2010-0420)

Antti Hayrynen discovered that Pidgin incorrectly handled large numbers of smileys. A remote attacker could send a specially crafted message and cause Pidgin to become unresponsive, leading to a denial of service. (CVE-2010-0423).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated pidgin packages that fix three security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

An input sanitization flaw was found in the way Pidgin's MSN protocol implementation handled MSNSLP invitations. A remote attacker could send a specially crafted INVITE request that would cause a denial of service (memory corruption and Pidgin crash). (CVE-2010-0277)

A denial of service flaw was found in Finch's XMPP chat implementation, when using multi-user chat. If a Finch user in a multi-user chat session were to change their nickname to contain the HTML 'br' element, it would cause Finch to crash. (CVE-2010-0420)

Red Hat would like to thank Sadrul Habib Chowdhury of the Pidgin project for responsibly reporting the CVE-2010-0420 issue.

A denial of service flaw was found in the way Pidgin processed emoticon images. A remote attacker could flood the victim with emoticon images during mutual communication, leading to excessive CPU use. (CVE-2010-0423)

These packages upgrade Pidgin to version 2.6.6. Refer to the Pidgin release notes for a full list of changes:
http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users are advised to upgrade to these updated packages, which correct these issues. Pidgin must be restarted for this update to take effect.

Multiple security vulnerabilities has been identified and fixed in pidgin :

Certain malformed SLP messages can trigger a crash because the MSN protocol plugin fails to check that all pieces of the message are set correctly (CVE-2010-0277).

In a user in a multi-user chat room has a nickname containing '<br>' then libpurple ends up having two users with username ' ' in the room, and Finch crashes in this situation. We do not believe there is a possibility of remote code execution (CVE-2010-0420).

oCERT notified us about a problem in Pidgin, where a large amount of processing time will be used when inserting many smileys into an IM or chat window. This should not cause a crash, but Pidgin can become unusable slow (CVE-2010-0423).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

This update provides pidgin 2.6.6, which is not vulnerable to these issues.

ID	Name	Product	Family	Severity
68001	Oracle Linux 4 : pidgin (ELSA-2010-0115)	Nessus	Oracle Linux Local Security Checks	medium
60738	Scientific Linux Security Update : pidgin on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
51728	SuSE 10 Security Update : pidgin (ZYPP Patch Number 6861)	Nessus	SuSE Local Security Checks	medium
51727	SuSE 10 Security Update : pidgin (ZYPP Patch Number 6856)	Nessus	SuSE Local Security Checks	medium
47286	Fedora 13 : pidgin-2.6.6-1.fc13 (2010-1934)	Nessus	Fedora Local Security Checks	medium
47252	Fedora 12 : pidgin-2.6.6-1.fc12 (2010-1383)	Nessus	Fedora Local Security Checks	medium
47244	Fedora 11 : pidgin-2.6.6-1.fc11 (2010-1279)	Nessus	Fedora Local Security Checks	critical
46177	Mandriva Linux Security Advisory : pidgin (MDVSA-2010:085)	Nessus	Mandriva Local Security Checks	medium
45585	FreeBSD : pidgin -- multiple remote denial of service vulnerabilities (a2c4d3d5-4c7b-11df-83fb-0015587e2cc1)	Nessus	FreeBSD Local Security Checks	medium
45560	Debian DSA-2038-1 : pidgin - several vulnerabilities	Nessus	Debian Local Security Checks	medium
45024	Slackware 12.0 / 12.1 / 12.2 / 13.0 / current : pidgin (SSA:2010-069-01)	Nessus	Slackware Local Security Checks	medium
44982	openSUSE Security Update : finch (finch-2032)	Nessus	SuSE Local Security Checks	medium
44979	openSUSE Security Update : finch (finch-2032)	Nessus	SuSE Local Security Checks	medium
44976	openSUSE Security Update : finch (finch-2032)	Nessus	SuSE Local Security Checks	medium
44965	SuSE 11 Security Update : pidgin (SAT Patch Number 2019)	Nessus	SuSE Local Security Checks	medium
44688	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : pidgin vulnerabilities (USN-902-1)	Nessus	Ubuntu Local Security Checks	medium
44671	CentOS 4 / 5 : pidgin (CESA-2010:0115)	Nessus	CentOS Local Security Checks	medium
44666	RHEL 4 / 5 : pidgin (RHSA-2010:0115)	Nessus	Red Hat Local Security Checks	medium
44664	Mandriva Linux Security Advisory : pidgin (MDVSA-2010:041)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-0420

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium