National Cyber Awareness System

Vulnerability Summary for CVE-2008-2927

Overview

Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and (2) libpurple/protocols/msnp9/slplink.c in Pidgin before 2.4.3 and Adium before 1.3 allow remote attackers to execute arbitrary code via a malformed SLP message with a crafted offset value, a different vulnerability than CVE-2008-2955.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-2647

Hyperlink:https://issues.rpath.com/browse/RPL-2647

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=453764

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=453764

External Source: XF

Name: adium-msnprotocol-code-execution(44774)

Hyperlink:http://xforce.iss.net/xforce/xfdb/44774

External Source: MISC

Name: http://www.zerodayinitiative.com/advisories/ZDI-08-054

Hyperlink:http://www.zerodayinitiative.com/advisories/ZDI-08-054

External Source: VUPEN

Name: ADV-2008-2032

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2008/2032/references

External Source: UBUNTU

Name: USN-675-2

Hyperlink:http://www.ubuntu.com/usn/USN-675-2

External Source: UBUNTU

Name: USN-675-1

Hyperlink:http://www.ubuntu.com/usn/USN-675-1

External Source: SECTRACK

Name: 1020451

Hyperlink:http://www.securitytracker.com/id?1020451

External Source: BID

Name: 29956

Hyperlink:http://www.securityfocus.com/bid/29956

External Source: BUGTRAQ

Name: 20080828 ZDI-08-054: Multiple Vendor libpurple MSN Protocol SLP Message Heap Overflow Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/495818/100/0/threaded

External Source: BUGTRAQ

Name: 20080806 rPSA-2008-0246-1 gaim

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/495165/100/0/threaded

External Source: BUGTRAQ

Name: 20080625 Pidgin 2.4.1 Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/493682

External Source: REDHAT

Name: RHSA-2008:0584

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0584.html

External Source: CONFIRM

Name: http://www.pidgin.im/news/security/?id=25

Hyperlink:http://www.pidgin.im/news/security/?id=25

External Source: MLIST

Name: [oss-security] 20080703 Re: Re: CVE Request (pidgin)

Hyperlink:http://www.openwall.com/lists/oss-security/2008/07/04/1

External Source: MLIST

Name: [oss-security] 20080704 Re: Re: CVE Request (pidgin)

Hyperlink:http://www.openwall.com/lists/oss-security/2008/07/03/6

External Source: MANDRIVA

Name: MDVSA-2009:127

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:127

External Source: MANDRIVA

Name: MDVSA-2008:143

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:143

External Source: DEBIAN

Name: DSA-1610

Hyperlink:http://www.debian.org/security/2008/dsa-1610

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0246

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0246

External Source: SECUNIA

Name: 32861

Hyperlink:http://secunia.com/advisories/32861

External Source: SECUNIA

Name: 32859

Hyperlink:http://secunia.com/advisories/32859

External Source: SECUNIA

Name: 31642

Type: Advisory

Hyperlink:http://secunia.com/advisories/31642

External Source: SECUNIA

Name: 31387

Type: Advisory

Hyperlink:http://secunia.com/advisories/31387

External Source: SECUNIA

Name: 31105

Type: Advisory

Hyperlink:http://secunia.com/advisories/31105

External Source: SECUNIA

Name: 31016

Type: Advisory

Hyperlink:http://secunia.com/advisories/31016

External Source: SECUNIA

Name: 30971

Type: Advisory

Hyperlink:http://secunia.com/advisories/30971

External Source: OVAL

Name: oval:org.mitre.oval:def:11695

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11695

External Source: CONFIRM

Name: http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msnp9/slplink.c

Hyperlink:http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msnp9/slplink.c

External Source: CONFIRM

Name: http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msn/slplink.c

Hyperlink:http://developer.pidgin.im/viewmtn/revision/diff/6eb1949a96fa80a4c744fc749c2562abc4cc9ed6/with/c3831c9181f4f61b747321240086ee79e4a08fd8/libpurple/protocols/msn/slplink.c

References to Check Content

Identifier:oval:org.mitre.oval:def:11695

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11695