Bug 1348876 (CVE-2016-2372)

Summary: CVE-2016-2372 pidgin: MXIT File Transfer Length Memory Disclosure Vulnerability
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: cschalle, debarshir, itamar, jskarvad, jsynacek, mbarnes, stu
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: pidgin 2.11.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:55:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1350338, 1403136    
Bug Blocks: 1348890    

Description Andrej Nemec 2016-06-22 09:02:12 UTC 
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out of bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.

External references:

http://www.talosintel.com/reports/TALOS-2016-0140/
http://www.pidgin.im/news/security/?id=105

Upstream fixes:

https://bitbucket.org/pidgin/main/commits/5e3601f8bde4
https://bitbucket.org/pidgin/main/commits/1c5197a66760
https://bitbucket.org/pidgin/main/commits/648f667a679c