The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the way Pidgin's     Mxit plug-in handled emoticons. A malicious remote     server or a man-in-the-middle attacker could     potentially use this flaw to crash Pidgin by sending a     specially crafted emoticon. (CVE-2014-3695)

  - A denial of service flaw was found in the way Pidgin     parsed Groupwise server messages. A malicious remote     server or a man-in-the-middle attacker could     potentially use this flaw to cause Pidgin to consume an     excessive amount of memory, possibly leading to a     crash, by sending a specially crafted message.
    (CVE-2014-3696)

  - An information disclosure flaw was discovered in the     way Pidgin parsed XMPP messages. A malicious remote     server or a man-in-the-middle attacker could     potentially use this flaw to disclose a portion of     memory belonging to the Pidgin process by sending a     specially crafted XMPP message. (CVE-2014-3698)

  - An out-of-bounds write flaw was found in the way Pidgin     processed XML content. A malicious remote server could     potentially use this flaw to crash Pidgin or execute     arbitrary code in the context of the pidgin process.
    (CVE-2017-2640)

  - It was found that Pidgin's SSL/TLS plug-ins had a flaw     in the certificate validation functionality. An     attacker could use this flaw to create a fake     certificate, that Pidgin would trust, which could be     used to conduct man-in-the-middle attacks against     Pidgin. (CVE-2014-3694)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for pidgin is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

The following packages have been upgraded to a later upstream version:
pidgin (2.10.11). (BZ#1369526)

Security Fix(es) :

* A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695)

* A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696)

* An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698)

* An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640)

* It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin.
(CVE-2014-3694)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Yves Younan (Cisco Talos) and Richard Johnson (Cisco Talos) as the original reporters of CVE-2014-3695 and CVE-2014-3696; Thijs Alkemade and Paul Aurich as the original reporters of CVE-2014-3698; and Jacob Appelbaum and Moxie Marlinspike as the original reporters of CVE-2014-3694.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
pidgin (2.10.11).

Security Fix(es) :

  - A denial of service flaw was found in the way Pidgin's     Mxit plug-in handled emoticons. A malicious remote     server or a man-in-the-middle attacker could potentially     use this flaw to crash Pidgin by sending a specially     crafted emoticon. (CVE-2014-3695)

  - A denial of service flaw was found in the way Pidgin     parsed Groupwise server messages. A malicious remote     server or a man-in-the-middle attacker could potentially     use this flaw to cause Pidgin to consume an excessive     amount of memory, possibly leading to a crash, by     sending a specially crafted message. (CVE-2014-3696)

  - An information disclosure flaw was discovered in the way     Pidgin parsed XMPP messages. A malicious remote server     or a man-in-the-middle attacker could potentially use     this flaw to disclose a portion of memory belonging to     the Pidgin process by sending a specially crafted XMPP     message. (CVE-2014-3698)

  - An out-of-bounds write flaw was found in the way Pidgin     processed XML content. A malicious remote server could     potentially use this flaw to crash Pidgin or execute     arbitrary code in the context of the pidgin process.
    (CVE-2017-2640)

  - It was found that Pidgin's SSL/TLS plug-ins had a flaw     in the certificate validation functionality. An attacker     could use this flaw to create a fake certificate, that     Pidgin would trust, which could be used to conduct     man-in-the-middle attacks against Pidgin.
    (CVE-2014-3694)

From Red Hat Security Advisory 2017:1854 :

An update for pidgin is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

The following packages have been upgraded to a later upstream version:
pidgin (2.10.11). (BZ#1369526)

Security Fix(es) :

* A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgin by sending a specially crafted emoticon. (CVE-2014-3695)

* A denial of service flaw was found in the way Pidgin parsed Groupwise server messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to cause Pidgin to consume an excessive amount of memory, possibly leading to a crash, by sending a specially crafted message. (CVE-2014-3696)

* An information disclosure flaw was discovered in the way Pidgin parsed XMPP messages. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to disclose a portion of memory belonging to the Pidgin process by sending a specially crafted XMPP message. (CVE-2014-3698)

* An out-of-bounds write flaw was found in the way Pidgin processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. (CVE-2017-2640)

* It was found that Pidgin's SSL/TLS plug-ins had a flaw in the certificate validation functionality. An attacker could use this flaw to create a fake certificate, that Pidgin would trust, which could be used to conduct man-in-the-middle attacks against Pidgin.
(CVE-2014-3694)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Yves Younan (Cisco Talos) and Richard Johnson (Cisco Talos) as the original reporters of CVE-2014-3695 and CVE-2014-3696; Thijs Alkemade and Paul Aurich as the original reporters of CVE-2014-3698; and Jacob Appelbaum and Moxie Marlinspike as the original reporters of CVE-2014-3694.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

- Update to version 2.10.10 :

  + General :

  - Check the basic constraints extension when validating     SSL/TLS certificates. This fixes a security hole that     allowed a malicious man-in-the-middle to impersonate an     IM server or any other https endpoint. This affected     both the NSS and GnuTLS plugins (CVE-2014-3694,     boo#902495).

  - Allow and prefer TLS 1.2 and 1.1 when using the NSS     plugin for SSL (im#15909).

  + libpurple3 compatibility :

  - Encrypted account passwords are preserved until the new     one is set.

  - Fix loading Google Talk and Facebook XMPP accounts.

  + Windows-Specific Changes: Don't allow overwriting     arbitrary files on the file system when the user     installs a smiley theme via drag-and-drop     (CVE-2014-3697).

  + Finch: Fix build against Python 3 (im#15969).

  + Gadu-Gadu: Updated internal libgadu to version 1.12.0.

  + Groupwise: Fix potential remote crash parsing server     message that indicates that a large amount of memory     should be allocated (CVE-2014-3696, boo#902410).

  + IRC: Fix a possible leak of unencrypted data when using     /me command with OTR (im#15750).

  + MXit: Fix potential remote crash parsing a malformed     emoticon response (CVE-2014-3695, boo#902409).

  + XMPP :

  - Fix potential information leak where a malicious XMPP     server and possibly even a malicious remote user could     create a carefully crafted XMPP message that causes     libpurple to send an XMPP message containing arbitrary     memory (CVE-2014-3698, boo#902408).

  - Fix Facebook XMPP roster quirks (im#15041, im#15957).

  + Yahoo: Fix login when using the GnuTLS library for TLS     connections (im#16172, boo#874606).

  - Drop pidgin-gstreamer1.patch: causes crashes and Video     still does not work (boo#853038). Drop BuildRequires     conditions switching to GStreamer 1.0.

  - Rebase pidgin-crash-missing-gst-registry.patch.

  + add pidgin-crash-missing-gst-registry.patch according to     the GST doc, 'gst_init' should be called before any     other calls.

The following issues were fixed in this update :

  + General :

  - Check the basic constraints extension when validating     SSL/TLS certificates. This fixes a security hole that     allowed a malicious man-in-the-middle to impersonate an     IM server or any other https endpoint. This affected     both the NSS and GnuTLS plugins (CVE-2014-3694,     boo#902495).

  - Allow and prefer TLS 1.2 and 1.1 when using the NSS     plugin for SSL (im#15909).

  + libpurple3 compatibility :

  - Encrypted account passwords are preserved until the new     one is set.

  - Fix loading Google Talk and Facebook XMPP accounts.

  + Groupwise: Fix potential remote crash parsing server     message that indicates that a large amount of memory     should be allocated (CVE-2014-3696, boo#902410).

  + IRC: Fix a possible leak of unencrypted data when using     /me command with OTR (im#15750).

  + MXit: Fix potential remote crash parsing a malformed     emoticon response (CVE-2014-3695, boo#902409).

  + XMPP :

  - Fix potential information leak where a malicious XMPP     server and possibly even a malicious remote user could     create a carefully crafted XMPP message that causes     libpurple to send an XMPP message containing arbitrary     memory (CVE-2014-3698, boo#902408).

  + Yahoo: Fix login when using the GnuTLS library for TLS     connections (im#16172, boo#874606).

fix build on arches without valgrind Update to 2.10.10 Security fix for CVE-2014-3694, CVE-2014-3695, CVE-2014-3696, CVE-2014-3698

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.10.10 Security fix for CVE-2014-3694, CVE-2014-3695, CVE-2014-3696, CVE-2014-3698

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jacob Appelbaum and an anonymous person discovered that Pidgin incorrectly handled certificate validation. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2014-3694)

Yves Younan and Richard Johnson discovered that Pidgin incorrectly handled certain malformed MXit emoticons. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2014-3695)

Yves Younan and Richard Johnson discovered that Pidgin incorrectly handled certain malformed Groupwise messages. A malicious remote server or a man in the middle could use this issue to cause Pidgin to crash, resulting in a denial of service. (CVE-2014-3696)

Thijs Alkemade and Paul Aurich discovered that Pidgin incorrectly handled memory when processing XMPP messages. A malicious remote server or user could use this issue to cause Pidgin to disclosure arbitrary memory, resulting in an information leak. (CVE-2014-3698).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Pidgin installed on the remote host is a version prior to 2.10.10. It is, therefore, affected by the following vulnerabilities :

  - An error exists in the included libpurple library     related the SSL Basic Constraints extension and     Certificate Authority (CA) verification that allows     intermediate certificates to be trusted as a CA.
    (CVE-2014-3694)

  - An error exists in the included libpurple library     related to emoticon handling that allows an attacker to     crash the application. (CVE-2014-3695)

  - An error exists in the included libpurple library     related to 'Groupwise' message handling and UI memory     management that allows an attacker to crash the     application. (CVE-2014-3696)

  - An error exists related to handling 'untar' operations     on 'smiley themes' that allows arbitrary file     overwrites. This issue only affects installs on     Microsoft Windows. (CVE-2014-3697)

  - An error exists in the included libpurple library     related to handling XMPP messages that allows an     attacker to obtain arbitrary memory contents.
    (CVE-2014-3698)

Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client :

  - CVE-2014-3694     It was discovered that the SSL/TLS plugins failed to     validate the basic constraints extension in intermediate     CA certificates.

  - CVE-2014-3695     Yves Younan and Richard Johnson discovered that     emoticons with overly large length values could crash     Pidgin.

  - CVE-2014-3696     Yves Younan and Richard Johnson discovered that     malformed Groupwise messages could crash Pidgin.

  - CVE-2014-3698     Thijs Alkemade and Paul Aurich discovered that malformed     XMPP messages could result in memory disclosure.

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

The remote host is running a vulnerable version of Pidgin chat client.  This version of Pidgin is vulnerable to multiple flaws which would allow an attacker to read/write arbitrary data, subvert security tokens, cause a denial of service, and more.

ID	Name	Product	Family	Severity
103004	EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2017-1166)	Nessus	Huawei Local Security Checks	critical
103003	EulerOS 2.0 SP1 : pidgin (EulerOS-SA-2017-1165)	Nessus	Huawei Local Security Checks	critical
102736	CentOS 7 : pidgin (CESA-2017:1854)	Nessus	CentOS Local Security Checks	critical
102651	Scientific Linux Security Update : pidgin on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	critical
102283	Oracle Linux 7 : pidgin (ELSA-2017-1854)	Nessus	Oracle Linux Local Security Checks	critical
102102	RHEL 7 : pidgin (RHSA-2017:1854)	Nessus	Red Hat Local Security Checks	critical
79223	openSUSE Security Update : pidgin (openSUSE-SU-2014:1397-1)	Nessus	SuSE Local Security Checks	medium
79101	openSUSE Security Update : pidgin (openSUSE-SU-2014:1376-1)	Nessus	SuSE Local Security Checks	medium
79093	Fedora 21 : pidgin-2.10.10-2.fc21 (2014-14112)	Nessus	Fedora Local Security Checks	medium
79091	Fedora 20 : pidgin-2.10.10-1.fc20 (2014-14069)	Nessus	Fedora Local Security Checks	medium
78723	Ubuntu 14.04 LTS : Pidgin vulnerabilities (USN-2390-1)	Nessus	Ubuntu Local Security Checks	medium
78689	Pidgin < 2.10.10 Multiple Vulnerabilities	Nessus	Windows	medium
78663	FreeBSD : libpurple/pidgin -- multiple vulnerabilities (d057c5e6-5b20-11e4-bebd-000c2980a9f3)	Nessus	FreeBSD Local Security Checks	medium
78659	Debian DSA-3055-1 : pidgin - security update	Nessus	Debian Local Security Checks	medium
78657	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : pidgin (SSA:2014-296-02)	Nessus	Slackware Local Security Checks	medium
8575	Pidgin < 2.10.10	Nessus Network Monitor	Internet Messengers	medium

Detections

Analytics

CVE-2014-3694

low

Tenable Plugins

critical

critical

critical

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium