Re: Re: CVE Request (pidgin)

[Vincent Danen <vdanen () linsec ca>]

* [2008-07-05 13:56:00 +0200] Nico Golde wrote:

> Hi Vincent,
> * Vincent Danen <vdanen () linsec ca> [2008-07-03 21:42]:
> > * [2008-07-01 17:25:40 -0400] Steven M. Christey wrote:
> > >Name: CVE-2008-2957
> > >Status: Candidate
> > >URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2957
> > >Reference: MISC:http://crisp.cs.du.edu/?q=ca2007-1
> > >Reference: MLIST:[oss-security] 20080627 CVE Request (pidgin)
> > >Reference: URL:http://www.openwall.com/lists/oss-security/2008/06/27/3
> > >
> > >The UPnP functionality in Pidgin 2.0.0, and possibly other versions,
> > >allows remote attackers to trigger the download of arbitrary files and
> > >cause a denial of service (memory or disk consumption) via a UDP
> > >packet that specifies an arbitrary URL.
> >
> > There are patches with the original advisory for these two.  Has anyone
> > had a chance to look at them to make sure they're ok?  I don't see any
> > references to any of these issues on the pidgin website and no vendors
> > have issued pidgin updates for these that I can see, so I'm wondering if
> > anyone has looked at these patches (be it vendors or upstream) to
> > determine whether or not they're sufficient and/or suitable to apply to
> > a security update.
>
> I just had a look at http://crisp.cs.du.edu/crisp-files/pidgin-2.0.0-upnp-limit-download.diff 
> to fix CVE-2008-2957. I think the patch itself is fine 
> however I am not sure if this is the right way to fix the 
> issue cause I basically just workarounds the problem by 
> limiting the downloads triggered by UPnP (128k) without 
> giving any way to reconfigure this value or to switch it off 
> completely. This may be the reason why there isn't yet an 
> official patch by the pidgin people.
>
> If you want to go with that simple workaround the patch is 
> just fine.

Thanks for looking at it, Nico.  I think the consensus of the Pidgin
developers is that neither issue is very serious, which I think is
another reason why it hasn't been fixed upstream yet.  I think that I'm
going to do is just wait for them to fix it upstream before fixing
anything (if they determine it isn't really a vulnerability, then I'd
rather not waste my time fixing something that isn't really an issue).

--
Vincent Danen @ http://linsec.ca/

Attachment: _bin
Description: