The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.

GNOME 2.6.0_x86: Instant Messaging patch.
Date this patch was last updated by Sun : Nov/30/10

GNOME 2.6.0: Instant Messaging patch.
Date this patch was last updated by Sun : Nov/30/10

From Red Hat Security Advisory 2009:1536 :

Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. The AOL Open System for Communication in Realtime (OSCAR) protocol is used by the AOL ICQ and AIM instant messaging systems.

An invalid pointer dereference bug was found in the way the Pidgin OSCAR protocol implementation processed lists of contacts. A remote attacker could send a specially crafted contact list to a user running Pidgin, causing Pidgin to crash. (CVE-2009-3615)

These packages upgrade Pidgin to version 2.6.3. Refer to the Pidgin release notes for a full list of changes:
http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users should upgrade to these updated packages, which correct this issue. Pidgin must be restarted for this update to take effect.

From Red Hat Security Advisory 2009:1535 :

An updated pidgin package that fixes several security issues is now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

An invalid pointer dereference bug was found in the way the Pidgin OSCAR protocol implementation processed lists of contacts. A remote attacker could send a specially crafted contact list to a user running Pidgin, causing Pidgin to crash. (CVE-2009-3615)

A NULL pointer dereference flaw was found in the way the Pidgin IRC protocol plug-in handles IRC topics. A malicious IRC server could send a specially crafted IRC TOPIC message, which once received by Pidgin, would lead to a denial of service (Pidgin crash). (CVE-2009-2703)

A NULL pointer dereference flaw was found in the way the Pidgin MSN protocol plug-in handles improper MSNSLP invitations. A remote attacker could send a specially crafted MSNSLP invitation request, which once accepted by a valid Pidgin user, would lead to a denial of service (Pidgin crash). (CVE-2009-3083)

All Pidgin users should upgrade to this updated package, which contains backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.

An invalid pointer dereference bug was found in the way the Pidgin OSCAR protocol implementation processed lists of contacts. A remote attacker could send a specially crafted contact list to a user running Pidgin, causing Pidgin to crash. (CVE-2009-3615)

A NULL pointer dereference flaw was found in the way the Pidgin IRC protocol plug-in handles IRC topics. A malicious IRC server could send a specially crafted IRC TOPIC message, which once received by Pidgin, would lead to a denial of service (Pidgin crash). (CVE-2009-2703) - SL3 only

A NULL pointer dereference flaw was found in the way the Pidgin MSN protocol plug-in handles improper MSNSLP invitations. A remote attacker could send a specially crafted MSNSLP invitation request, which once accepted by a valid Pidgin user, would lead to a denial of service (Pidgin crash). (CVE-2009-3083) - SL3 only

Pidgin must be restarted for this update to take effect.

This update of pidgin fixes the following issues :

  - Allowed to send confidential data unencrypted even if     SSL was chosen by user. (CVE-2009-3026: CVSS v2 Base     Score: 5.0)

  - Remote denial of service in yahoo IM plug-in.
    (CVE-2009-3025: CVSS v2 Base Score: 4.3)

  - Remote denial of service in MSN plug-in. (CVE-2009-3083:
    CVSS v2 Base Score: 5.0)

  - Remote denial of service in MSN plug-in. (CVE-2009-3084:
    CVSS v2 Base Score: 5.0)

  - Remote denial of service in XMPP plug-in.
    (CVE-2009-3085: CVSS v2 Base Score: 5.0)

  - Remote denial of service in ICQ plug-in. (CVE-2009-3615:
    CVSS v2 Base Score: 5.0)

  - QQ protocol upgrade Migrate all QQ accounts to QQ2008.

Security vulnerabilities has been identified and fixed in pidgin :

The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client (CVE-2009-3615).

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon (CVE-2010-0013).

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon (CVE-2010-0013).

Certain malformed SLP messages can trigger a crash because the MSN protocol plugin fails to check that all pieces of the message are set correctly (CVE-2010-0277).

In a user in a multi-user chat room has a nickname containing '<br>' then libpurple ends up having two users with username ' ' in the room, and Finch crashes in this situation. We do not believe there is a possibility of remote code execution (CVE-2010-0420).

oCERT notified us about a problem in Pidgin, where a large amount of processing time will be used when inserting many smileys into an IM or chat window. This should not cause a crash, but Pidgin can become unusable slow (CVE-2010-0423).

Packages for 2009.0 are provided due to the Extended Maintenance Program.

This update provides pidgin 2.6.6, which is not vulnerable to these issues.

It was discovered that incorrect pointer handling in the purple library, an internal component of the multi-protocol instant messaging client Pidgin, could lead to denial of service or the execution of arbitrary code through malformed contact requests.

It was discovered that Pidgin did not properly handle certain topic messages in the IRC protocol handler. If a user were tricked into connecting to a malicious IRC server, an attacker could cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-2703)

It was discovered that Pidgin did not properly enforce the 'require TLS/SSL' setting when connecting to certain older Jabber servers. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. This issue only affected Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-3026)

It was discovered that Pidgin did not properly handle certain SLP invite messages in the MSN protocol handler. A remote attacker could send a specially crafted invite message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-3083)

It was discovered that Pidgin did not properly handle certain errors in the XMPP protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.10 and Ubuntu 9.04.
(CVE-2009-3085)

It was discovered that Pidgin did not properly handle malformed contact-list data in the OSCAR protocol handler. A remote attacker could send specially crafted contact-list data and cause Pidgin to crash, leading to a denial of service. (CVE-2009-3615)

It was discovered that Pidgin did not properly handle custom smiley requests in the MSN protocol handler. A remote attacker could send a specially crafted filename in a custom smiley request and obtain arbitrary files via directory traversal. This issue only affected Ubuntu 8.10, Ubuntu 9.04 and Ubuntu 9.10. (CVE-2010-0013)

Pidgin for Ubuntu 8.04 LTS was also updated to fix connection issues with the MSN protocol.

USN-675-1 and USN-781-1 provided updated Pidgin packages to fix multiple security vulnerabilities in Ubuntu 8.04 LTS. The security patches to fix CVE-2008-2955 and CVE-2009-1376 were incomplete. This update corrects the problem. 

It was discovered that Pidgin did not properly handle file transfers containing a long filename and special characters in the MSN protocol handler. A remote attacker could send a specially crafted filename in a file transfer request and cause Pidgin to crash, leading to a denial of service. (CVE-2008-2955)

It was discovered that Pidgin did not properly handle certain malformed messages in the MSN protocol handler. A remote attacker could send a specially crafted message and possibly execute arbitrary code with user privileges.
(CVE-2009-1376).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security vulnerabilities has been identified and fixed in pidgin :

The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client (CVE-2009-3615).

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon (CVE-2010-0013).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

This update provides pidgin 2.6.5, which is not vulnerable to these issues.

This update of pidgin fixes the following issues :

  - CVE-2009-3026: CVSS v2 Base Score: 5.0 Allowed to send     confidential data unencrypted even if SSL was chosen by     user.

  - CVE-2009-3025: CVSS v2 Base Score: 4.3 Remote denial of     service in yahoo IM plug-in.

  - CVE-2009-3083: CVSS v2 Base Score: 5.0 Remote denial of     service in MSN plug-in.

  - CVE-2009-3084: CVSS v2 Base Score: 5.0 Remote denial of     service in MSN plug-in.

  - CVE-2009-3085: CVSS v2 Base Score: 5.0 Remote denial of     service in XMPP plug-in.

  - CVE-2009-3615: CVSS v2 Base Score: 5.0 Remote denial of     service in ICQ plug-in.

  - QQ protocol upgrade Migrate all QQ accounts to QQ2008.

This update of pidgin fixes the following issues :

  - Allowed to send confidential data unencrypted even if     SSL was chosen by user. (CVE-2009-3026: CVSS v2 Base     Score: 5.0)

  - Remote denial of service in yahoo IM plug-in.
    (CVE-2009-3025: CVSS v2 Base Score: 4.3)

  - Remote denial of service in MSN plug-in. (CVE-2009-3083:
    CVSS v2 Base Score: 5.0)

  - Remote denial of service in MSN plug-in. (CVE-2009-3084:
    CVSS v2 Base Score: 5.0)

  - Remote denial of service in XMPP plug-in.
    (CVE-2009-3085: CVSS v2 Base Score: 5.0)

  - Remote denial of service in ICQ plug-in. (CVE-2009-3615:
    CVSS v2 Base Score: 5.0)

Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. The AOL Open System for Communication in Realtime (OSCAR) protocol is used by the AOL ICQ and AIM instant messaging systems.

An invalid pointer dereference bug was found in the way the Pidgin OSCAR protocol implementation processed lists of contacts. A remote attacker could send a specially crafted contact list to a user running Pidgin, causing Pidgin to crash. (CVE-2009-3615)

These packages upgrade Pidgin to version 2.6.3. Refer to the Pidgin release notes for a full list of changes:
http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users should upgrade to these updated packages, which correct this issue. Pidgin must be restarted for this update to take effect.

An updated pidgin package that fixes several security issues is now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

An invalid pointer dereference bug was found in the way the Pidgin OSCAR protocol implementation processed lists of contacts. A remote attacker could send a specially crafted contact list to a user running Pidgin, causing Pidgin to crash. (CVE-2009-3615)

A NULL pointer dereference flaw was found in the way the Pidgin IRC protocol plug-in handles IRC topics. A malicious IRC server could send a specially crafted IRC TOPIC message, which once received by Pidgin, would lead to a denial of service (Pidgin crash). (CVE-2009-2703)

A NULL pointer dereference flaw was found in the way the Pidgin MSN protocol plug-in handles improper MSNSLP invitations. A remote attacker could send a specially crafted MSNSLP invitation request, which once accepted by a valid Pidgin user, would lead to a denial of service (Pidgin crash). (CVE-2009-3083)

All Pidgin users should upgrade to this updated package, which contains backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.

This update fixes :

  - Bug #529357 - CVE-2009-3615 Pidgin: Invalid pointer     dereference (crash) after receiving contacts from SIM IM     client

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New pidgin packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix a security issue.

ID	Name	Product	Family	Severity
108035	Solaris 10 (x86) : 143318-03	Nessus	Solaris Local Security Checks	medium
107540	Solaris 10 (sparc) : 143317-03	Nessus	Solaris Local Security Checks	medium
67951	Oracle Linux 4 : pidgin (ELSA-2009-1536)	Nessus	Oracle Linux Local Security Checks	medium
67950	Oracle Linux 3 : pidgin (ELSA-2009-1535)	Nessus	Oracle Linux Local Security Checks	medium
60686	Scientific Linux Security Update : pidgin on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
51726	SuSE 10 Security Update : pidgin (ZYPP Patch Number 6710)	Nessus	SuSE Local Security Checks	medium
51725	SuSE 10 Security Update : pidgin (ZYPP Patch Number 6709)	Nessus	SuSE Local Security Checks	medium
46177	Mandriva Linux Security Advisory : pidgin (MDVSA-2010:085)	Nessus	Mandriva Local Security Checks	medium
44797	Debian DSA-1932-1 : pidgin - programming error	Nessus	Debian Local Security Checks	medium
44057	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : pidgin vulnerabilities (USN-886-1)	Nessus	Ubuntu Local Security Checks	critical
43853	Mandriva Linux Security Advisory : pidgin (MDVSA-2010:001)	Nessus	Mandriva Local Security Checks	medium
43054	openSUSE Security Update : finch (finch-1625)	Nessus	SuSE Local Security Checks	medium
43052	openSUSE Security Update : finch (finch-1625)	Nessus	SuSE Local Security Checks	medium
43050	openSUSE Security Update : finch (finch-1625)	Nessus	SuSE Local Security Checks	medium
42989	SuSE 11 Security Update : pidgin (SAT Patch Number 1604)	Nessus	SuSE Local Security Checks	medium
42330	CentOS 4 / 5 : pidgin (CESA-2009:1536)	Nessus	CentOS Local Security Checks	medium
42313	RHEL 4 / 5 : pidgin (RHSA-2009:1536)	Nessus	Red Hat Local Security Checks	medium
42312	RHEL 3 : pidgin (RHSA-2009:1535)	Nessus	Red Hat Local Security Checks	medium
42309	CentOS 3 : pidgin (CESA-2009:1535)	Nessus	CentOS Local Security Checks	medium
42195	Fedora 10 : pidgin-2.6.3-2.fc10 (2009-10702)	Nessus	Fedora Local Security Checks	critical
42193	Fedora 11 : pidgin-2.6.3-2.fc11 (2009-10662)	Nessus	Fedora Local Security Checks	critical
42169	Slackware 12.0 / 12.1 / 12.2 / 13.0 / current : pidgin (SSA:2009-290-02)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2009-3615

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

medium