Pidgin 'msn_oim_report_to_user()' Denial of Service Vulnerability

Bugtraq ID:	52475
Class:	Design Error
CVE:	CVE-2012-1178
Remote:	Yes
Local:	No
Published:	Mar 14 2012 12:00AM
Updated:	Apr 16 2015 05:43PM
Credit:	Thijs Alkemade
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise SDK 11 SP2 SuSE SUSE Linux Enterprise SDK 11 SP1 SuSE SUSE Linux Enterprise SDK 10 SP4 SuSE SUSE Linux Enterprise Desktop 11 SP2 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Desktop 11 SP1 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Desktop 10 SP4 + Linux kernel 2.6.5 Sun Solaris 10 RedHat Enterprise Linux Optional Productivity Application 5 server RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Pidgin Pidgin 2.10.1 Pidgin Pidgin 2.9 Pidgin Pidgin 2.8 Pidgin Pidgin 2.7.6 Pidgin Pidgin 2.7.5 Pidgin Pidgin 2.7.4 Pidgin Pidgin 2.7.3 Pidgin Pidgin 2.7.2 Pidgin Pidgin 2.7.1 Pidgin Pidgin 2.7 Pidgin Pidgin 2.6.6 Pidgin Pidgin 2.6.5 Pidgin Pidgin 2.6.4 Pidgin Pidgin 2.6.3 Pidgin Pidgin 2.6.1 Pidgin Pidgin 2.6 Pidgin Pidgin 2.5.9 Pidgin Pidgin 2.5.8 Pidgin Pidgin 2.5.7 Pidgin Pidgin 2.5.6 Pidgin Pidgin 2.5.5 Pidgin Pidgin 2.4.3 Pidgin Pidgin 2.4.2 Pidgin Pidgin 2.4.1 Pidgin Pidgin 2.4 Pidgin Pidgin 2.2.2 Pidgin Pidgin 2.2.1 Pidgin Pidgin 2.2 Pidgin Pidgin 2.1 Pidgin Pidgin 2.0.2 Pidgin Pidgin 2.0 Pidgin Pidgin 2.10.0 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5
Not Vulnerable:	Pidgin Pidgin 2.10.2

Pidgin 'msn_oim_report_to_user()' Denial of Service Vulnerability

Pidgin is prone to a denial-of-service vulnerability.

Successful exploits will cause the affected application to crash, effectively denying service to legitimate users.

Versions prior to Pidgin 2.10.2 are vulnerable.

Pidgin 'msn_oim_report_to_user()' Denial of Service Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Pidgin 'msn_oim_report_to_user()' Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva finch-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64finch0-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64purple-devel-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64purple0-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-bonjour-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-client-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-gevolution-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-i18n-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-meanwhile-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-perl-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-plugins-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-silc-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-tcl-2.10.2-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva finch-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libfinch0-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libpurple-devel-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libpurple0-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-bonjour-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-client-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-gevolution-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-i18n-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-meanwhile-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-perl-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-plugins-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-silc-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-tcl-2.10.2-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2011 x86_64

• Mandriva finch-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64finch0-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64purple-devel-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64purple0-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-bonjour-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-client-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-gevolution-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-i18n-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-meanwhile-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-perl-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-plugins-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-silc-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-tcl-2.10.2-0.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2011

• Mandriva finch-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libfinch0-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libpurple-devel-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libpurple0-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-bonjour-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-client-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-gevolution-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-i18n-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-meanwhile-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-perl-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-plugins-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-silc-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva pidgin-tcl-2.10.2-0.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/

Pidgin 'msn_oim_report_to_user()' Denial of Service Vulnerability

References:

• ChangeLog: Pidgin and Finch - The Pimpin' Penguin IM Clients That're Good For Th (Pidgin)
  
• msn_oim_report_to_user does not do charset verification/conversion (Pidgin)
  
• Pidgin Homepage (Pidgin)
  
• Pidgin Security Advisory (Pidgin)