National Vulnerability Database (NVD) National Vulnerability Database (CVE-2010-0277)

National Cyber Awareness System

Vulnerability Summary for CVE-2010-0277

Original release date:01/09/2010

Last revised:11/24/2010

Source: US-CERT/NIST

Overview

slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.6, including 2.6.4, and Adium 1.3.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed MSNSLP INVITE request in an SLP message, a different issue than CVE-2010-0013.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:N/I:N/A:P) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 10.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type:Allows disruption of serviceUnknown

Vendor Statements (disclaimer)

Official Statement from Red Hat (02/22/2010)

This issue was addressed for Red Hat Enterprise Linux 4 and 5 via https://rhn.redhat.com/errata/RHSA-2010-0115.html We currently have no plans to fix this flaw in Red Hat Enterprise Linux 3 as the MSN protocol support in the provided version of Pidgin (1.5.1) is out-dated and no longer supported by MSN servers. There are no plans to backport MSN protocol changes for that version of Pidgin.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: REDHAT

Name: RHSA-2010:0115

Hyperlink:https://rhn.redhat.com/errata/RHSA-2010-0115.html

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=554335

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=554335

External Source: VUPEN

Name: ADV-2010-2693

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/2693

External Source: VUPEN

Name: ADV-2010-1020

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/1020

External Source: VUPEN

Name: ADV-2010-0413

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/0413

External Source: UBUNTU

Name: USN-902-1

Hyperlink:http://www.ubuntu.com/usn/USN-902-1

External Source: BID

Name: 38294

Hyperlink:http://www.securityfocus.com/bid/38294

External Source: MLIST

Name: [oss-security] 20100107 Re: CVE request - pidgin MSN arbitrary file upload

Hyperlink:http://www.openwall.com/lists/oss-security/2010/01/07/2

External Source: MANDRIVA

Name: MDVSA-2010:085

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:085

External Source: MANDRIVA

Name: MDVSA-2010:041

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:041

External Source: SECUNIA

Name: 41868

Type: Advisory

Hyperlink:http://secunia.com/advisories/41868

External Source: SECUNIA

Name: 38915

Type: Advisory

Hyperlink:http://secunia.com/advisories/38915

External Source: SECUNIA

Name: 38712

Type: Advisory

Hyperlink:http://secunia.com/advisories/38712

External Source: SECUNIA

Name: 38658

Type: Advisory

Hyperlink:http://secunia.com/advisories/38658

External Source: SECUNIA

Name: 38640

Type: Advisory

Hyperlink:http://secunia.com/advisories/38640

External Source: SECUNIA

Name: 38563

Type: Advisory

Hyperlink:http://secunia.com/advisories/38563

External Source: CONFIRM

Name: http://pidgin.im/news/security/?id=43

Hyperlink:http://pidgin.im/news/security/?id=43

External Source: OVAL

Name: oval:org.mitre.oval:def:9421

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9421

External Source: SUSE

Name: SUSE-SR:2010:006

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html

External Source: FEDORA

Name: FEDORA-2010-1383

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035409.html

External Source: FEDORA

Name: FEDORA-2010-1934

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035347.html

External Source: FEDORA

Name: FEDORA-2010-1279

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035332.html

External Source: MISC

Name: http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html

Hyperlink:http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html

External Source: CONFIRM

Name: http://developer.pidgin.im/wiki/ChangeLog

Hyperlink:http://developer.pidgin.im/wiki/ChangeLog

External Source: CONFIRM

Name: http://blogs.sun.com/security/entry/cve_2010_0277_malformed_msn

Hyperlink:http://blogs.sun.com/security/entry/cve_2010_0277_malformed_msn

References to Check Content

Identifier:oval:org.mitre.oval:def:9421

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9421

Vulnerable software and versions

Configuration 1

* cpe:/a:pidgin:pidgin:2.6.4

* cpe:/a:adium:adium:1.3.8

* cpe:/a:pidgin:pidgin:2.5.9

* cpe:/a:pidgin:pidgin:2.5.8

* cpe:/a:pidgin:pidgin:2.5.2

* cpe:/a:pidgin:pidgin:2.5.3

* cpe:/a:pidgin:pidgin:2.5.0

* cpe:/a:pidgin:pidgin:2.5.1

* cpe:/a:pidgin:pidgin:2.5.4

* cpe:/a:pidgin:pidgin:2.5.5

* cpe:/a:pidgin:pidgin:2.5.6

* cpe:/a:pidgin:pidgin:2.5.7

* cpe:/a:pidgin:pidgin:2.6.5 and previous versions

* cpe:/a:pidgin:pidgin:2.6.2

* cpe:/a:pidgin:pidgin:2.6.1

* cpe:/a:pidgin:pidgin:2.6.0

* cpe:/a:pidgin:pidgin:2.4.0

* cpe:/a:pidgin:pidgin:2.4.1

* cpe:/a:pidgin:pidgin:2.4.2

* cpe:/a:pidgin:pidgin:2.4.3

* cpe:/a:pidgin:pidgin:2.3.1

* cpe:/a:pidgin:pidgin:2.3.0

* cpe:/a:pidgin:pidgin:2.2.0

* cpe:/a:pidgin:pidgin:2.2.1

* cpe:/a:pidgin:pidgin:2.2.2

* cpe:/a:pidgin:pidgin:2.1.1

* cpe:/a:pidgin:pidgin:2.1.0

* cpe:/a:pidgin:pidgin:2.0.2

* cpe:/a:pidgin:pidgin:2.0.1

* cpe:/a:pidgin:pidgin:2.0.0

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Resource Management Errors (CWE-399)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0277