Bugtraq mailing list archives
Re: [Full-disclosure] pidgin OTR information leakage
From: Michele Orru <antisnatchor () gmail com>
Date: Mon, 27 Feb 2012 20:37:04 +0100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jann Horn wrote:
2012/2/25 Dimitris Glynos <dimitris () census-labs com>:Pidgin transmits OTR (off-the-record) conversations over DBUS in plaintext. This makes it possible for attackers that have gained user-level access on a host, to listen in on private conversations associated with the victim account.Basically, you're saying that if I have the rights of a user on a machine, I can access the private conversations of that user? Ooooh no. Well, I can also copy his keyfiles, no? And I can alter his settings. And spawn fake "Update didn't work, please enter root password to proceed" windows. I could alter his ~/.bashrc so that whenever he launches "sudo" or "su", a script is launched instead that grabs his password. So, please, what's the point?
I think you didn't understood the content of the advisory. If there are 10 non-root users in an Ubuntu machine for example, if user 1 is using pidgin with OTR compiled with DBUS, then user 2 to 10 can see what user 1 pidgin conversation. "Simple" as that, without impersonating user 1 or knowing his password. Cheers antisnatchor
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPS9tfAAoJEBgl8Z+oSxe4fv8IAIHrER/TssgDxUmQrpcs11Ud eYdxLG897aa7plBwi8bABSVR/0moO4cH0w3dvcgIYJ1kSlxiy6NLqlGi9SF6biAx Yw4uDDeaQggO9CMS8FX/Dn8JNhZUxQ47C0M4hydd8Irg5FPPUBRDcXkcH5MjI35v GcbSx2MEN5YrSvn4C6z2M3MJcuyhROlWfsa68cBc3EVIe4CjWTK1NLxCidXLrn8V aXtGOpnrXZPoJeNjhCQGvhnAUMdn2W5PQjF24f6hzqb8vHkF7Y0ZunD9IxoWhnMU sNGCcUNAEEDXfGUV6LtkwZOP1l6W7bZTRNqT7C8Jsp/K4Pfbit+ALXIhIlQZCds= =zebT -----END PGP SIGNATURE-----
Current thread:
- pidgin OTR information leakage Dimitris Glynos (Feb 27)
- Re: pidgin OTR information leakage Jann Horn (Feb 27)
- Re: [Full-disclosure] pidgin OTR information leakage Michele Orru (Feb 27)
- Re: [Full-disclosure] pidgin OTR information leakage Rich Pieri (Feb 27)
- Re: [Full-disclosure] pidgin OTR information leakage Jeffrey Walton (Feb 28)
- Message not available
- Re: [Full-disclosure] pidgin OTR information leakage Dimitris Glynos (Feb 28)
- Re: [Full-disclosure] pidgin OTR information leakage Dimitris Glynos (Feb 28)
- Re: [Full-disclosure] pidgin OTR information leakage Michele Orru (Feb 27)
- Re: pidgin OTR information leakage Jann Horn (Feb 27)