Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pidgin: Out-of-bounds write in purple_markup_unescape_entity triggered by invalid XML (CVE-2017-2640)

  - Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive     information via a dbus session monitor. (CVE-2012-1257)

  - The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin     before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509     certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain     sensitive information via a crafted certificate. (CVE-2014-3694)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pidgin: MXIT g_snprintf Multiple Buffer Overflow Vulnerabilities (CVE-2016-2368)

  - pidgin: Eavesdropping hashed password when logging (CVE-2016-2379)

  - libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote     Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary     code via a crafted message. (CVE-2014-3775)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pidgin: Out-of-bounds write in purple_markup_unescape_entity triggered by invalid XML (CVE-2017-2640)

  - cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process     memory, which might allow local users to obtain sensitive information by reading a core file or other     representation of memory contents. (CVE-2011-4922)

  - Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive     information via a dbus session monitor. (CVE-2012-1257)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol in Pidgin. Specially crafted MXIT     data sent by the server could potentially result in an     out-of-bounds write of one byte. A malicious server can     send a negative content-length in response to a HTTP     request triggering the vulnerability.(CVE-2016-2377)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol in Pidgin. Specially crafted MXIT     data sent from the server could potentially result in     arbitrary code execution. A malicious server or an     attacker who intercepts the network traffic can send an     invalid size for a packet which will trigger a buffer     overflow.(CVE-2016-2376)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol Pidgin. Specially crafted data     sent via the server could potentially result in a     buffer overflow, potentially resulting in memory     corruption. A malicious server or an unfiltered     malicious user can send negative length values to     trigger this vulnerability.(CVE-2016-2378)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent from the server could     potentially result in an out-of-bounds read. A     malicious server or man-in-the-middle attacker can send     invalid data to trigger this     vulnerability.(CVE-2016-2370)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in a null pointer dereference. A malicious     server or an attacker who intercepts the network     traffic can send invalid data to trigger this     vulnerability and cause a crash.(CVE-2016-2365)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in an out-of-bounds read. A malicious server or     an attacker who intercepts the network traffic can send     invalid data to trigger this vulnerability and cause a     crash.(CVE-2016-2366)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in an out-of-bounds read. A malicious server or     user can send an invalid mood to trigger this     vulnerability.(CVE-2016-2373)

  - A directory traversal exists in the handling of the     MXIT protocol in Pidgin. Specially crafted MXIT data     sent from the server could potentially result in an     overwrite of files. A malicious server or someone with     access to the network traffic can provide an invalid     filename for a splash image triggering the     vulnerability.(CVE-2016-4323)

  - A NULL pointer dereference vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in a denial of service vulnerability. A     malicious server can send a packet starting with a NULL     byte triggering the vulnerability.(CVE-2016-2369)

  - An exploitable memory corruption vulnerability exists     in the handling of the MXIT protocol in Pidgin.
    Specially crafted MXIT MultiMX message sent via the     server can result in an out-of-bounds write leading to     memory disclosure and code execution.(CVE-2016-2374)

  - An exploitable out-of-bounds read exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT contact information sent from the server     can result in memory disclosure.(CVE-2016-2375)

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent to     the server could potentially result in an out-of-bounds     read. A user could be convinced to enter a particular     string which would then get converted incorrectly and     could lead to a potential out-of-bounds     read.(CVE-2016-2380)

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent     via the server could potentially result in an     out-of-bounds read. A malicious user, server, or     man-in-the-middle attacker can send an invalid size for     a file transfer which will trigger an out-of-bounds     read vulnerability. This could result in a denial of     service or copy data from memory to the file, resulting     in an information leak if the file is sent to another     user.(CVE-2016-2372)

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent     via the server could potentially result in an     out-of-bounds read. A malicious user, server, or     man-in-the-middle can send an invalid size for an     avatar which will trigger an out-of-bounds read     vulnerability. This could result in a denial of service     or copy data from memory to the file, resulting in an     information leak if the avatar is sent to another     user.(CVE-2016-2367)

  - An out-of-bounds write vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could cause     memory corruption resulting in code     execution.(CVE-2016-2371)

  - Multiple memory corruption vulnerabilities exist in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could result in     multiple buffer overflows, potentially resulting in     code execution or memory disclosure.(CVE-2016-2368)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent     via the server could potentially result in an     out-of-bounds read. A malicious user, server, or     man-in-the-middle can send an invalid size for an     avatar which will trigger an out-of-bounds read     vulnerability. This could result in a denial of service     or copy data from memory to the file, resulting in an     information leak if the avatar is sent to another     user.(CVE-2016-2367)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent from the server could     potentially result in an out-of-bounds read. A     malicious server or man-in-the-middle attacker can send     invalid data to trigger this     vulnerability.(CVE-2016-2370)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in a null pointer dereference. A malicious     server or an attacker who intercepts the network     traffic can send invalid data to trigger this     vulnerability and cause a crash.(CVE-2016-2365)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol Pidgin. Specially crafted data     sent via the server could potentially result in a     buffer overflow, potentially resulting in memory     corruption. A malicious server or an unfiltered     malicious user can send negative length values to     trigger this vulnerability.(CVE-2016-2378)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in an out-of-bounds read. A malicious server or     an attacker who intercepts the network traffic can send     invalid data to trigger this vulnerability and cause a     crash.(CVE-2016-2366 )

  - Multiple memory corruption vulnerabilities exist in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could result in     multiple buffer overflows, potentially resulting in     code execution or memory disclosure.(CVE-2016-2368)

  - A NULL pointer dereference vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in a denial of service vulnerability. A     malicious server can send a packet starting with a NULL     byte triggering the vulnerability.(CVE-2016-2369)

  - An out-of-bounds write vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could cause     memory corruption resulting in code     execution.(CVE-2016-2371)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in an out-of-bounds read. A malicious server or     user can send an invalid mood to trigger this     vulnerability.(CVE-2016-2373)

  - An exploitable memory corruption vulnerability exists     in the handling of the MXIT protocol in Pidgin.
    Specially crafted MXIT MultiMX message sent via the     server can result in an out-of-bounds write leading to     memory disclosure and code execution.(CVE-2016-2374)

  - An exploitable out-of-bounds read exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT contact information sent from the server     can result in memory disclosure.(CVE-2016-2375)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol in Pidgin. Specially crafted MXIT     data sent from the server could potentially result in     arbitrary code execution. A malicious server or an     attacker who intercepts the network traffic can send an     invalid size for a packet which will trigger a buffer     overflow.(CVE-2016-2376)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol in Pidgin. Specially crafted MXIT     data sent by the server could potentially result in an     out-of-bounds write of one byte. A malicious server can     send a negative content-length in response to a HTTP     request triggering the vulnerability.(CVE-2016-2377)

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent to     the server could potentially result in an out-of-bounds     read. A user could be convinced to enter a particular     string which would then get converted incorrectly and     could lead to a potential out-of-bounds     read.(CVE-2016-2380)

  - A directory traversal exists in the handling of the     MXIT protocol in Pidgin. Specially crafted MXIT data     sent from the server could potentially result in an     overwrite of files. A malicious server or someone with     access to the network traffic can provide an invalid     filename for a splash image triggering the     vulnerability.(CVE-2016-4323)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Multiple memory corruption vulnerabilities exist in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could result in     multiple buffer overflows, potentially resulting in     code execution or memory disclosure. (CVE-2016-2368)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-38 (Pidgin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pidgin. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might send specially crafted data using the MXit       protocol, possibly resulting in the remote execution of arbitrary code       with the privileges of the process, a Denial of Service condition, or in       leaking confidential information.
  Workaround :

    There is no known workaround at this time.

Yves Younan of Cisco Talos discovered several vulnerabilities in the MXit protocol support in pidgin, a multi-protocol instant messaging client. A remote attacker can take advantage of these flaws to cause a denial of service (application crash), overwrite files, information disclosure, or potentially to execute arbitrary code.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3031-1 advisory.

    Yves Younan discovered that Pidgin contained multiple issues in the MXit protocol support. A remote     attacker could use this issue to cause Pidgin to crash, resulting in a denial of service, or possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Numerous security issues have been identified and fixed in Pidgin in Debian/Wheezy.

CVE-2016-2365

MXIT Markup Command Denial of Service Vulnerability

CVE-2016-2366

MXIT Table Command Denial of Service Vulnerability

CVE-2016-2367

MXIT Avatar Length Memory Disclosure Vulnerability

CVE-2016-2368

MXIT g_snprintf Multiple Buffer Overflow Vulnerabilities

CVE-2016-2369

MXIT CP_SOCK_REC_TERM Denial of Service Vulnerability

CVE-2016-2370

MXIT Custom Resource Denial of Service Vulnerability

CVE-2016-2371

MXIT Extended Profiles Code Execution Vulnerability

CVE-2016-2372

MXIT File Transfer Length Memory Disclosure Vulnerability

CVE-2016-2373

MXIT Contact Mood Denial of Service Vulnerability

CVE-2016-2374

MXIT MultiMX Message Code Execution Vulnerability

CVE-2016-2375

MXIT Suggested Contacts Memory Disclosure Vulnerability

CVE-2016-2376

MXIT read stage 0x3 Code Execution Vulnerability

CVE-2016-2377

MXIT HTTP Content-Length Buffer Overflow Vulnerability

CVE-2016-2378

MXIT get_utf8_string Code Execution Vulnerability

CVE-2016-2380

MXIT mxit_convert_markup_tx Information Leak Vulnerability

CVE-2016-4323

MXIT Splash Image Arbitrary File Overwrite Vulnerability

For Debian 7 'Wheezy', these problems have been fixed in version 2.10.10-1~deb7u2.

We recommend that you upgrade your pidgin packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Pidgin installed on the remote Windows host is prior to 2.11.0. It is, therefore, affected by multiple vulnerabilities :

  - A NULL pointer dereference flaw exists when handling the     MXIT protocol. A remote attacker can exploit this, via     crafted MXIT data, to cause a denial of service.
    (CVE-2016-2365)

  - Multiple out-of-bounds read errors exist when handling     the MXIT protocol. A remote attacker can exploit these,     via crafted MXIT data, to cause a denial of service.
    (CVE-2016-2366, CVE-2016-2370)

  - An out-of-bounds read error exists when handling the     MXIT protocol. A remote attacker can exploit this, via     an invalid size for an avatar, to disclose memory     contents or cause a denial of service. (CVE-2016-2367)

  - Multiple memory corruption issues exist when handling     the MXIT protocol. A remote attacker can exploit these,     via crafted MXIT data, to disclose memory contents or     execute arbitrary code. (CVE-2016-2368)

  - A NULL pointer dereference flaw exists when handling the     MXIT protocol. A remote attacker can exploit this, via     crafted MXIT packet starting with a NULL byte, to cause     a denial of service. (CVE-2016-2369)

  - An out-of-bounds write error exists when handling the     MXIT protocol. A remote attacker can exploit this, via     crafted MXIT data, to corrupt memory, resulting in the     execution of arbitrary code. (CVE-2016-2371)

  - An out-of-bounds read error exists when handling the     MXIT protocol. A remote attacker can exploit this, via     an invalid size for a file transfer, to disclose memory     contents or cause a denial of service. (CVE-2016-2372)

  - An out-of-bounds read error exists when handling the     MXIT protocol. A remote attacker can exploit this, by     sending an invalid mood, to cause a denial of service.
    (CVE-2016-2373)

  - An out-of-bounds write error exists when handling the     MXIT protocol. A remote attacker can exploit this, via     crafted MXIT MultiMX messages, to disclose memory     contents or execute arbitrary code. (CVE-2016-2374)

  - An out-of-bounds read error exists when handling the     MXIT protocol. A remote attacker can exploit this, via     crafted MXIT contact information, to disclose memory     contents. (CVE-2016-2375)

  - A buffer overflow condition exists when handling the     MXIT protocol. A remote attacker can exploit this, via     a crafted packet having an invalid size, to execute     arbitrary code. (CVE-2016-2376)

  - An out-of-bounds write error exists when handling the     MXIT protocol. A remote attacker can exploit this, via     a negative content-length response to an HTTP request,     to cause a denial of service. (CVE-2016-2377)

  - A buffer overflow condition exists when handling the     MXIT protocol. A remote attacker can exploit this, via     crafted data using negative length values, to cause a     denial of service. (CVE-2016-2378)

  - A flaw exists in MXIT due to using weak cryptography     when encrypting a user password. A man-in-the-middle     attacker able to access login messages can exploit this     to impersonate the user. (CVE-2016-2379)

  - An out-of-bounds read error exists when handling the     MXIT protocol. A remote attacker can exploit this, via     a crafted local message, to disclose memory contents.
    (CVE-2016-2380)

  - A directory traversal flaw exists when handling the     MXIT protocol. A remote attacker can exploit this, via     crafted MXIT data using an invalid file name for a     splash image, to overwrite files. (CVE-2016-4323)

  - An unspecified vulnerability exists due to X.509     certificates not being properly imported when using     GnuTLS. No other details are available.

ID	Name	Product	Family	Severity
199367	RHEL 6 : pidgin (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199333	RHEL 7 : pidgin (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199298	RHEL 5 : pidgin (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196315	RHEL 6 : pidgin (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196274	RHEL 7 : pidgin (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196266	RHEL 5 : pidgin (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
132185	EulerOS 2.0 SP3 : pidgin (EulerOS-SA-2019-2650)	Nessus	Huawei Local Security Checks	high
131879	EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2019-2387)	Nessus	Huawei Local Security Checks	high
129179	EulerOS 2.0 SP5 : pidgin (EulerOS-SA-2019-1985)	Nessus	Huawei Local Security Checks	high
96542	GLSA-201701-38 : Pidgin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
92328	Debian DSA-3620-1 : pidgin - security update	Nessus	Debian Local Security Checks	high
92033	Ubuntu 14.04 LTS : Pidgin vulnerabilities (USN-3031-1)	Nessus	Ubuntu Local Security Checks	high
91922	Debian DLA-542-1 : pidgin security update	Nessus	Debian Local Security Checks	high
91784	Pidgin < 2.11.0 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2016-2368

high

Tenable Plugins

critical

high

critical

critical

high

critical

high

high

high

critical

high

high

high

high