libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.

From Red Hat Security Advisory 2010:0890 :

Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

Multiple NULL pointer dereference flaws were found in the way Pidgin handled Base64 decoding. A remote attacker could use these flaws to crash Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol, MSN, MySpace, or Extensible Messaging and Presence Protocol (XMPP) protocol plug-ins, or using the Microsoft NT LAN Manager (NTLM) protocol for authentication. (CVE-2010-3711)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Daniel Atallah as the original reporter.

All Pidgin users should upgrade to these updated packages, which contain a backported patch to resolve these issues. Pidgin must be restarted for this update to take effect.

From Red Hat Security Advisory 2010:0788 :

Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

Multiple NULL pointer dereference flaws were found in the way Pidgin handled Base64 decoding. A remote attacker could use these flaws to crash Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol, MSN, MySpace, or Extensible Messaging and Presence Protocol (XMPP) protocol plug-ins, or using the Microsoft NT LAN Manager (NTLM) protocol for authentication. (CVE-2010-3711)

A NULL pointer dereference flaw was found in the way the Pidgin MSN protocol plug-in processed custom emoticon messages. A remote attacker could use this flaw to crash Pidgin by sending specially crafted emoticon messages during mutual communication. (CVE-2010-1624)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Daniel Atallah as the original reporter of CVE-2010-3711, and Pierre Nogues of Meta Security as the original reporter of CVE-2010-1624.

All Pidgin users should upgrade to these updated packages, which contain backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.

Multiple NULL pointer dereference flaws were found in the way Pidgin handled Base64 decoding. A remote attacker could use these flaws to crash Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol, MSN, MySpace, or Extensible Messaging and Presence Protocol (XMPP) protocol plug-ins, or using the Microsoft NT LAN Manager (NTLM) protocol for authentication. (CVE-2010-3711)

Pidgin must be restarted for this update to take effect.

Multiple NULL pointer dereference flaws were found in the way Pidgin handled Base64 decoding. A remote attacker could use these flaws to crash Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol, MSN, MySpace, or Extensible Messaging and Presence Protocol (XMPP) protocol plug-ins, or using the Microsoft NT LAN Manager (NTLM) protocol for authentication. (CVE-2010-3711)

A NULL pointer dereference flaw was found in the way the Pidgin MSN protocol plug-in processed custom emoticon messages. A remote attacker could use this flaw to crash Pidgin by sending specially crafted emoticon messages during mutual communication. (CVE-2010-1624)

Pidgin must be restarted for this update to take effect.

This update fixes the following security issues :

  - 604225: MSN emoticon DoS. (CVE-2010-1624)

  - 648273: multiple NULL pointer dereference weaknesses.
    (CVE-2010-3711)

  - 722199: vulnerability in SILC protocol handling     (CVE-2011-3594)

New pidgin packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix a security issue.

Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously.

Multiple NULL pointer dereference flaws were found in the way Pidgin handled Base64 decoding. A remote attacker could use these flaws to crash Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol, MSN, MySpace, or Extensible Messaging and Presence Protocol (XMPP) protocol plug-ins, or using the Microsoft NT LAN Manager (NTLM) protocol for authentication. (CVE-2010-3711)

A NULL pointer dereference flaw was found in the way the Pidgin MSN protocol plug-in processed custom emoticon messages. A remote attacker could use this flaw to crash Pidgin by sending specially crafted emoticon messages during mutual communication. (CVE-2010-1624)

Red Hat would like to thank the Pidgin project for reporting these issues. Upstream acknowledges Daniel Atallah as the original reporter of CVE-2010-3711, and Pierre Nogues of Meta Security as the original reporter of CVE-2010-1624.

All Pidgin users should upgrade to these updated packages, which contain backported patches to resolve these issues. Pidgin must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:0890 advisory.

  - Pidgin (libpurple): Multiple DoS (crash) flaws by processing of unsanitized Base64 decoder values     (CVE-2010-3711)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New release 2.7.5

Full Upstream ChangeLog :

  -     http://developer.pidgin.im/wiki/ChangeLog#version2.7.410     202010

    -       http://developer.pidgin.im/wiki/ChangeLog#version2.7.5       10312010

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pierre Nogues discovered that Pidgin incorrectly handled malformed SLP messages in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-1624)

Daniel Atallah discovered that Pidgin incorrectly handled the return code of the Base64 decoding function. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. (CVE-2010-3711).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New release 2.7.4

Full Upstream ChangeLog :

http://developer.pidgin.im/wiki/ChangeLog

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A security vulnerability has been identified and fixed in pidgin :

It has been discovered that eight denial of service conditions exist in libpurple all due to insufficient validation of the return value from purple_base64_decode(). Invalid or malformed data received in place of a valid base64-encoded value in portions of the Yahoo!, MSN, MySpaceIM, and XMPP protocol plugins and the NTLM authentication support trigger a crash. These vulnerabilities can be leveraged by a remote user for denial of service (CVE-2010-3711).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

This update provides pidgin 2.7.4, which is not vulnerable to this issue.

ID	Name	Product	Family	Severity
68143	Oracle Linux 6 : pidgin (ELSA-2010-0890)	Nessus	Oracle Linux Local Security Checks	medium
68124	Oracle Linux 4 : pidgin (ELSA-2010-0788)	Nessus	Oracle Linux Local Security Checks	medium
60902	Scientific Linux Security Update : pidgin on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60876	Scientific Linux Security Update : pidgin on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57186	SuSE 10 Security Update : pidgin, libpurple and finch (ZYPP Patch Number 7827)	Nessus	SuSE Local Security Checks	medium
57100	SuSE 11.1 Security Update : pidgin, libpurple and finch (SAT Patch Number 5389)	Nessus	SuSE Local Security Checks	medium
57099	SuSE 11.1 Security Update : pidgin, libpurple and finch (SAT Patch Number 5389)	Nessus	SuSE Local Security Checks	medium
54891	Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : pidgin (SSA:2010-305-02)	Nessus	Slackware Local Security Checks	medium
50796	CentOS 4 / 5 : pidgin (CESA-2010:0788)	Nessus	CentOS Local Security Checks	medium
50643	RHEL 6 : pidgin (RHSA-2010:0890)	Nessus	Red Hat Local Security Checks	medium
50556	Fedora 12 : pidgin-2.7.5-1.fc12 (2010-17130)	Nessus	Fedora Local Security Checks	medium
50492	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : pidgin vulnerabilities (USN-1014-1)	Nessus	Ubuntu Local Security Checks	medium
50441	Fedora 13 : pidgin-2.7.4-1.fc13 (2010-16629)	Nessus	Fedora Local Security Checks	medium
50414	Fedora 14 : pidgin-2.7.4-1.fc14 (2010-16876)	Nessus	Fedora Local Security Checks	medium
50297	RHEL 4 / 5 : pidgin (RHSA-2010:0788)	Nessus	Red Hat Local Security Checks	medium
50296	Mandriva Linux Security Advisory : pidgin (MDVSA-2010:208)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-3711

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium