ZeroBox Vulnerability Database

漏洞起因
边界条件错误
 
影响系统
Pidgin Pidgin 2.5.5
Pidgin Pidgin 2.4.3
Pidgin Pidgin 2.4.2
Pidgin Pidgin 2.4.1
Pidgin Pidgin 2.2.2
Pidgin Pidgin 2.2.1
Pidgin Pidgin 2.2
 
不受影响系统
Pidgin Pidgin 2.5.6
 
危害
远程攻击者可以利用漏洞以应用程序权限执行任意指令，或对应用程序进行拒绝服务攻击。
 
攻击所需条件
攻击者必须访问Pidgin。
 
漏洞信息
Pidgin是一款支持多种协议的即时通讯客户端。
Pidgin存在多个缓冲区溢出漏洞，远程攻击者可以利用漏洞以应用程序权限执行任意指令。
-畸形SLP消息(MSN)可导致缓冲区溢出，大小检查不正确导致指派uint64类型为size_t，可导致整数溢出。
-在接收到畸形QQ报文时decrypt_out()函数存在错误，可导致拒绝服务攻击。
-多个协议中PurpleCircBuffer维护的缓冲区存在破坏问题，可导致拒绝服务攻击。
-当初始化外出文件传送时XMPP SOCKS5字节流服务器不正确检查缓冲区边界，可触发缓冲区溢出。
 
测试方法
 
厂商解决方案
可参考如下升级程序：
Debian Linux 5.0 hppa
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_hppa.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_hppa.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_hppa.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_hppa.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_hppa.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_hppa.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_hppa.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_hppa.deb
Debian Linux 5.0 ia-64
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_ia64.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_ia64.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_ia64.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_ia64.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_ia64.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_ia64.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_ia64.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_ia64.deb
Debian Linux 5.0 m68k
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian Linux 5.0 arm
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_arm.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_arm.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_arm.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_arm.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_arm.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_arm.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_arm.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_arm.deb
Debian Linux 5.0 armel
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_armel.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_armel.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_armel.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_armel.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_armel.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_armel.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_armel.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_armel.deb
Debian Linux 5.0
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian Linux 5.0 alpha
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_alpha.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_alpha.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_alpha.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_alpha.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_alpha.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_alpha.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_alpha.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_alpha.deb
Debian Linux 5.0 amd64
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_amd64.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_amd64.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_amd64.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_amd64.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_amd64.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_amd64.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_amd64.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_amd64.deb
Debian Linux 5.0 ia-32
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_i386.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_i386.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_i386.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_i386.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_i386.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_i386.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_i386.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_i386.deb
Debian Linux 5.0 mips
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_mips.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_mips.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_mips.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_mips.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_mips.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_mips.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_mips.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_mips.deb
Debian Linux 5.0 s/390
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_s390.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_s390.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_s390.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_s390.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_s390.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_s390.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_s390.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_s390.deb
Debian Linux 5.0 mipsel
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_mipsel.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_mipsel.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_mipsel.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_mipsel.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_mipsel.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_mipsel.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_mipsel.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_mipsel.deb
Debian Linux 5.0 powerpc
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_powerpc.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_powerpc.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_powerpc.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_powerpc.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_powerpc.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_powerpc.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_powerpc.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_powerpc.deb
Debian Linux 5.0 sparc
Debian finch-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch-dev_2.4.3– 4lenny2_all.deb
Debian finch_2.4.3-4lenny2_sparc.deb
http://security.debian.org/pool/updates/main/p/pidgin/finch_2.4.3-4len ny2_sparc.deb
Debian libpurple-bin_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-bin_2. 4.3-4lenny2_all.deb
Debian libpurple-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple-dev_2. 4.3-4lenny2_all.deb
Debian libpurple0_2.4.3-4lenny2_sparc.deb
http://security.debian.org/pool/updates/main/p/pidgin/libpurple0_2.4.3 -4lenny2_sparc.deb
Debian pidgin-data_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-data_2.4. 3-4lenny2_all.deb
Debian pidgin-dbg_2.4.3-4lenny2_sparc.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dbg_2.4.3 -4lenny2_sparc.deb
Debian pidgin-dev_2.4.3-4lenny2_all.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin-dev_2.4.3 -4lenny2_all.deb
Debian pidgin_2.4.3-4lenny2_sparc.deb
http://security.debian.org/pool/updates/main/p/pidgin/pidgin_2.4.3-4le nny2_sparc.deb
 
漏洞提供者
Veracode, Josef Andrysek, and Ka-Hing Cheung