Detections
Analytics
Pidgin < 2.5.6 Multiple Buffer Overflows
high Nessus Plugin ID 38866
Synopsis
The remote host is running an instant messaging client that is affected by multiple buffer overflow vulnerabilities.Description
The remote host is running Pidgin earlier than 2.5.6. Such versions are reportedly affected by multiple buffer overflow vulnerabilities :- A buffer overflow is possible when initiating a file transfer to a malicious buddy over XMPP. (CVE-2009-1373)
- A buffer overflow issue in the 'decrypt_out()' function can be exploited through specially crafted 'QQ' packets.
(CVE-2009-1374)
- A buffer maintained by PurpleCircBuffer which is used by XMPP and Sametime protocol plugins can be corrupted if it's exactly full and then more bytes are added to it.
(CVE-2009-1375)
- An integer-overflow issue exists in the application due to an incorrect typecasting of 'int64' to 'size_t'.
(CVE-2009-1376)
Solution
Upgrade to Pidgin 2.5.6 or later.See Also
http://www.pidgin.im/news/security/?id=29
http://www.pidgin.im/news/security/?id=30
Plugin Details
Severity: High
ID: 38866
File Name: pidgin_2_5_6.nasl
Version: 1.12
Type: local
Agent: windows
Family: Windows
Published: 5/22/2009
Updated: 7/24/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:pidgin:pidgin
Required KB Items: SMB/Pidgin/Version
Exploit Available: true
Exploit Ease: Exploits are available
Reference Information
CVE: CVE-2009-1373, CVE-2009-1374, CVE-2009-1375, CVE-2009-1376
BID: 35067