National Vulnerability Database (NVD) National Vulnerability Database (CVE-2010-0423)

National Cyber Awareness System

Vulnerability Summary for CVE-2010-0423

Original release date:02/24/2010

Last revised:08/21/2010

Source: US-CERT/NIST

Overview

gtkimhtml.c in Pidgin before 2.6.6 allows remote attackers to cause a denial of service (CPU consumption and application hang) by sending many smileys in a (1) IM or (2) chat.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:N/I:N/A:P) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 10.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type:Allows disruption of serviceUnknown

Vendor Statements (disclaimer)

Official Statement from Red Hat (02/25/2010)

The Red Hat Security Response Team has rated this issue as having low security impact. For Red Hat Enterprise Linux 4 and 5, this issue was addressed via https://rhn.redhat.com/errata/RHSA-2010-0115.html We currently have no plans to fix this flaw in Red Hat Enterprise Linux 3 as the issue only causes Pidgin client to become unresponsive or crash.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2010-0413

Type: Advisory; Patch Information

Hyperlink:http://www.vupen.com/english/advisories/2010/0413

External Source: CONFIRM

Name: http://pidgin.im/news/security/?id=45

Type: Advisory; Patch Information

Hyperlink:http://pidgin.im/news/security/?id=45

External Source: REDHAT

Name: RHSA-2010:0115

Hyperlink:https://rhn.redhat.com/errata/RHSA-2010-0115.html

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=565792

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=565792

External Source: XF

Name: pidgin-smileys-dos(56394)

Hyperlink:http://xforce.iss.net/xforce/xfdb/56394

External Source: VUPEN

Name: ADV-2010-1020

Hyperlink:http://www.vupen.com/english/advisories/2010/1020

External Source: VUPEN

Name: ADV-2010-0914

Hyperlink:http://www.vupen.com/english/advisories/2010/0914

External Source: UBUNTU

Name: USN-902-1

Hyperlink:http://www.ubuntu.com/usn/USN-902-1

External Source: BID

Name: 38294

Hyperlink:http://www.securityfocus.com/bid/38294

External Source: OSVDB

Name: 62440

Hyperlink:http://www.osvdb.org/62440

External Source: MANDRIVA

Name: MDVSA-2010:085

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:085

External Source: MANDRIVA

Name: MDVSA-2010:041

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:041

External Source: DEBIAN

Name: DSA-2038

Hyperlink:http://www.debian.org/security/2010/dsa-2038

External Source: SECUNIA

Name: 39509

Hyperlink:http://secunia.com/advisories/39509

External Source: SECUNIA

Name: 38915

Hyperlink:http://secunia.com/advisories/38915

External Source: SECUNIA

Name: 38712

Type: Advisory

Hyperlink:http://secunia.com/advisories/38712

External Source: SECUNIA

Name: 38658

Type: Advisory

Hyperlink:http://secunia.com/advisories/38658

External Source: SECUNIA

Name: 38640

Type: Advisory

Hyperlink:http://secunia.com/advisories/38640

External Source: SECUNIA

Name: 38563

Type: Advisory

Hyperlink:http://secunia.com/advisories/38563

External Source: OVAL

Name: oval:org.mitre.oval:def:9842

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9842

External Source: SUSE

Name: SUSE-SR:2010:006

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html

External Source: FEDORA

Name: FEDORA-2010-1383

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035409.html

External Source: FEDORA

Name: FEDORA-2010-1934

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035347.html

External Source: FEDORA

Name: FEDORA-2010-1279

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035332.html

External Source: CONFIRM

Name: http://developer.pidgin.im/wiki/ChangeLog

Hyperlink:http://developer.pidgin.im/wiki/ChangeLog

References to Check Content

Identifier:oval:org.mitre.oval:def:9842

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9842

Vulnerable software and versions

Configuration 1

* cpe:/a:pidgin:pidgin:2.6.5 and previous versions

* cpe:/a:pidgin:pidgin:2.6.4

* cpe:/a:pidgin:pidgin:2.6.2

* cpe:/a:pidgin:pidgin:2.6.1

* cpe:/a:pidgin:pidgin:2.6.0

* cpe:/a:pidgin:pidgin:2.5.9

* cpe:/a:pidgin:pidgin:2.5.8

* cpe:/a:pidgin:pidgin:2.5.7

* cpe:/a:pidgin:pidgin:2.5.6

* cpe:/a:pidgin:pidgin:2.5.5

* cpe:/a:pidgin:pidgin:2.5.4

* cpe:/a:pidgin:pidgin:2.5.3

* cpe:/a:pidgin:pidgin:2.5.2

* cpe:/a:pidgin:pidgin:2.5.1

* cpe:/a:pidgin:pidgin:2.5.0

* cpe:/a:pidgin:pidgin:2.4.3

* cpe:/a:pidgin:pidgin:2.4.2

* cpe:/a:pidgin:pidgin:2.4.1

* cpe:/a:pidgin:pidgin:2.4.0

* cpe:/a:pidgin:pidgin:2.3.1

* cpe:/a:pidgin:pidgin:2.3.0

* cpe:/a:pidgin:pidgin:2.2.2

* cpe:/a:pidgin:pidgin:2.2.1

* cpe:/a:pidgin:pidgin:2.2.0

* cpe:/a:pidgin:pidgin:2.1.1

* cpe:/a:pidgin:pidgin:2.1.0

* cpe:/a:pidgin:pidgin:2.0.2

* cpe:/a:pidgin:pidgin:2.0.1

* cpe:/a:pidgin:pidgin:2.0.0

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Resource Management Errors (CWE-399)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0423