oss-sec mailing list archives
Re: Re: CVE Request (pidgin)
From: Vincent Danen <vdanen () linsec ca>
Date: Tue, 8 Jul 2008 08:39:54 -0600
* [2008-07-05 13:56:00 +0200] Nico Golde wrote:
Hi Vincent, * Vincent Danen <vdanen () linsec ca> [2008-07-03 21:42]:* [2008-07-01 17:25:40 -0400] Steven M. Christey wrote: >Name: CVE-2008-2957 >Status: Candidate >URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2957 >Reference: MISC:http://crisp.cs.du.edu/?q=ca2007-1 >Reference: MLIST:[oss-security] 20080627 CVE Request (pidgin) >Reference: URL:http://www.openwall.com/lists/oss-security/2008/06/27/3 > >The UPnP functionality in Pidgin 2.0.0, and possibly other versions, >allows remote attackers to trigger the download of arbitrary files and >cause a denial of service (memory or disk consumption) via a UDP >packet that specifies an arbitrary URL. There are patches with the original advisory for these two. Has anyone had a chance to look at them to make sure they're ok? I don't see any references to any of these issues on the pidgin website and no vendors have issued pidgin updates for these that I can see, so I'm wondering if anyone has looked at these patches (be it vendors or upstream) to determine whether or not they're sufficient and/or suitable to apply to a security update.I just had a look at http://crisp.cs.du.edu/crisp-files/pidgin-2.0.0-upnp-limit-download.diff to fix CVE-2008-2957. I think the patch itself is fine however I am not sure if this is the right way to fix the issue cause I basically just workarounds the problem by limiting the downloads triggered by UPnP (128k) without giving any way to reconfigure this value or to switch it off completely. This may be the reason why there isn't yet an official patch by the pidgin people.If you want to go with that simple workaround the patch is just fine.
Thanks for looking at it, Nico. I think the consensus of the Pidgin developers is that neither issue is very serious, which I think is another reason why it hasn't been fixed upstream yet. I think that I'm going to do is just wait for them to fix it upstream before fixing anything (if they determine it isn't really a vulnerability, then I'd rather not waste my time fixing something that isn't really an issue). -- Vincent Danen @ http://linsec.ca/
Attachment:
_bin
Description:
Current thread:
- Re: CVE Request (pidgin) Steven M. Christey (Jul 01)
- Re: Re: CVE Request (pidgin) Nico Golde (Jul 03)
- Re: Re: CVE Request (pidgin) Josh Bressers (Jul 03)
- Re: Re: CVE Request (pidgin) Robert Buchholz (Jul 03)
- Re: Re: CVE Request (pidgin) Josh Bressers (Jul 03)
- Re: Re: CVE Request (pidgin) Josh Bressers (Jul 03)
- Re: Re: CVE Request (pidgin) Nico Golde (Jul 03)
- Re: Re: CVE Request (pidgin) Vincent Danen (Jul 03)
- Re: Re: CVE Request (pidgin) Nico Golde (Jul 05)
- Re: Re: CVE Request (pidgin) Vincent Danen (Jul 08)
- Re: Re: CVE Request (pidgin) Nico Golde (Jul 05)
- <Possible follow-ups>
- CVE Request (pidgin) Josh Bressers (Aug 05)
- Re: CVE Request (pidgin) Steven M. Christey (Aug 07)