Bug 521823 – CVE-2009-2703 Pidgin: NULL pointer dereference by handling IRC topic(s) (DoS)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 521823 - (CVE-2009-2703) CVE-2009-2703 Pidgin: NULL pointer dereference by handling IRC topic(s) (DoS)

Summary:	CVE-2009-2703 Pidgin: NULL pointer dereference by handling IRC topic(s) (DoS)

Status:	CLOSED ERRATA

Aliases:	CVE-2009-2703

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:	http://pidgin.im/news/security/?id=40
Whiteboard:	impact=low,public=20090903,reported=2...
Keywords:	Security

Depends On:	522536 522537 522538 522539 529416 833962
Blocks:
	Show dependency tree / graph

Reported:	2009-09-08 09:03 EDT by Jan Lieskovsky
Modified:	2016-03-04 06:46 EST (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2010-03-29 05:11:35 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
PoC from issue reporter - Cristofaro Mune (1.21 KB, application/x-python) 2009-09-08 09:14 EDT, Jan Lieskovsky	no flags	Details
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2009:1453	normal	SHIPPED_LIVE	Moderate: pidgin security update	2009-09-21 11:46:05 EDT
Red Hat Product Errata	RHSA-2009:1535	normal	SHIPPED_LIVE	Moderate: pidgin security update	2009-10-29 10:20:29 EDT

Groups: None (edit)

Description Jan Lieskovsky 2009-09-08 09:03:32 EDT

A NULL pointer dereference flaw was found in the Pidgin IRC protocol plugin,
by handling IRC topics. A malicious IRC server could send
a specially-crafted IRC TOPIC message, which once received by Pidgin
would lead to denial of service (Pidgin crash). 

References:
----------
http://pidgin.im/news/security/?id=40
http://pidgin.im/pipermail/devel/2009-September/008850.html

Upstream patch:
---------------
http://developer.pidgin.im/viewmtn/revision/info/ad2c6ee53ec9122b25aeb1f918db53be69bdeac3

Credit:
-------
Cristofaro Mune

Comment 1 Jan Lieskovsky 2009-09-08 09:08:30 EDT

This issue affects the versions of Pidgin package, as shipped
with Red Hat Enterprise Linux 3, 4, and 5. 

This issue was already addressed in the versions of Pidgin
package, as shipped with Fedora 10 and 11. Relevant versions:

Fedora 10: pidgin-2.6.2-1.fc10.1
Fedora 11: pidgin-2.6.2-1.fc11

Comment 3 Jan Lieskovsky 2009-09-08 09:14:23 EDT

Created attachment 360074 [details]
PoC from issue reporter - Cristofaro Mune

Comment 4 Jan Lieskovsky 2009-09-09 10:45:37 EDT

MITRE's CVE-2009-2703 record:
-----------------------------

libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple
in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of
service (NULL pointer dereference and application crash) via a TOPIC
message that lacks a topic string.

References:
-----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2703
http://developer.pidgin.im/viewmtn/revision/info/ad2c6ee53ec9122b25aeb1f918db53be69bdeac3
http://www.pidgin.im/news/security/index.php?id=40
http://www.securityfocus.com/bid/36277
http://secunia.com/advisories/36601

Comment 8 errata-xmlrpc 2009-09-21 11:46:21 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:1453 https://rhn.redhat.com/errata/RHSA-2009-1453.html

Comment 9 errata-xmlrpc 2009-10-29 10:20:34 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 3

Via RHSA-2009:1535 https://rhn.redhat.com/errata/RHSA-2009-1535.html

Note You need to log in before you can comment on or make changes to this bug.