The clientautoresp function in family_icbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via an X-Status message that lacks the expected end tag for a (1) desc or (2) title element.

GNOME 2.6.0_x86: Instant Messaging patch.
Date this patch was last updated by Sun : Nov/30/10

GNOME 2.6.0: Instant Messaging patch.
Date this patch was last updated by Sun : Nov/30/10

New pidgin packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix security issues.

A security vulnerability has been identified and fixed in pidgin :

The clientautoresp function in family_icbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via an X-Status message that lacks the expected end tag for a (1) desc or (2) title element (CVE-2010-2528).

Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products.

This update provides pidgin 2.7.3, which is not vulnerable to this issue.

New release to address a security issue and a couple of bugfixes Details at http://developer.pidgin.im/wiki/ChangeLog

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Pidgin installed on the remote host is earlier than 2.7.2.  Such versions have a denial of service vulnerability when processing a malformed X-Status message due to a reference to a NULL pointer in the oscar protocol plugin.

ID	Name	Product	Family	Severity
108035	Solaris 10 (x86) : 143318-03	Nessus	Solaris Local Security Checks	medium
107540	Solaris 10 (sparc) : 143317-03	Nessus	Solaris Local Security Checks	medium
48922	Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : pidgin (SSA:2010-240-05)	Nessus	Slackware Local Security Checks	medium
48318	Mandriva Linux Security Advisory : pidgin (MDVSA-2010:148)	Nessus	Mandriva Local Security Checks	medium
48206	Fedora 12 : pidgin-2.7.2-1.fc12 (2010-11315)	Nessus	Fedora Local Security Checks	medium
47841	Fedora 13 : pidgin-2.7.2-1.fc13 (2010-11321)	Nessus	Fedora Local Security Checks	medium
47802	Pidgin X-Status NULL Pointer Denial of Service	Nessus	Windows	medium

Detections

Analytics

CVE-2010-2528

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium