CVE-2009-1373

pidgin file transfer buffer overflow

Severity Score

7.1

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Buffer overflow in the XMPP SOCKS5 bytestream server in Pidgin (formerly Gaim) before 2.5.6 allows remote authenticated users to execute arbitrary code via vectors involving an outbound XMPP file transfer. NOTE: some of these details are obtained from third party information.

Desbordamiento de búfer en XMPP SOCKS5 bytestream server en Pidgin anteriores a v2.5.6 permite a usuarios remotos autenticados ejecutar código de forma arbitraria a través de vectores que incluyen una transferencia de fichero saliente XMPP. NOTA: Algunos de los detalles fueron obtenidos de información de terceros.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-04-23 CVE Reserved
2009-05-24 CVE Published
2023-11-24 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (26)

URL	Tag	Source
http://secunia.com/advisories/35188	Third Party Advisory
http://secunia.com/advisories/35215	Third Party Advisory
http://secunia.com/advisories/35294	Third Party Advisory
http://secunia.com/advisories/35329	Third Party Advisory
http://secunia.com/advisories/35330	Third Party Advisory
http://www.vupen.com/english/advisories/2009/1396	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/50682	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17722	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9005	Signature

URL	Date	SRC

URL	Date	SRC
http://www.pidgin.im/news/security/?id=29	2023-11-07
http://www.securityfocus.com/bid/35067	2023-11-07

URL	Date	SRC
http://debian.org/security/2009/dsa-1805	2023-11-07
http://secunia.com/advisories/35194	2023-11-07
http://secunia.com/advisories/35202	2023-11-07
http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml	2023-11-07
http://www.mandriva.com/security/advisories?name=MDVSA-2009:140	2023-11-07
http://www.mandriva.com/security/advisories?name=MDVSA-2009:173	2023-11-07
http://www.redhat.com/support/errata/RHSA-2009-1059.html	2023-11-07
http://www.redhat.com/support/errata/RHSA-2009-1060.html	2023-11-07
http://www.ubuntu.com/usn/USN-781-1	2023-11-07
http://www.ubuntu.com/usn/USN-781-2	2023-11-07
https://bugzilla.redhat.com/show_bug.cgi?id=500488	2009-05-22
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html	2023-11-07
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html	2023-11-07
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html	2023-11-07
https://access.redhat.com/security/cve/CVE-2009-1373	2009-05-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				<= 2.5.5 Search vendor "Pidgin" for product "Pidgin" and version " <= 2.5.5"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.0.0 Search vendor "Pidgin" for product "Pidgin" and version "2.0.0"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.0.1 Search vendor "Pidgin" for product "Pidgin" and version "2.0.1"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.0.2 Search vendor "Pidgin" for product "Pidgin" and version "2.0.2"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.0.2 Search vendor "Pidgin" for product "Pidgin" and version "2.0.2"		linux		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.1.0 Search vendor "Pidgin" for product "Pidgin" and version "2.1.0"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.1.1 Search vendor "Pidgin" for product "Pidgin" and version "2.1.1"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.2.0 Search vendor "Pidgin" for product "Pidgin" and version "2.2.0"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.2.1 Search vendor "Pidgin" for product "Pidgin" and version "2.2.1"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.2.2 Search vendor "Pidgin" for product "Pidgin" and version "2.2.2"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.3.0 Search vendor "Pidgin" for product "Pidgin" and version "2.3.0"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.3.1 Search vendor "Pidgin" for product "Pidgin" and version "2.3.1"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.4.0 Search vendor "Pidgin" for product "Pidgin" and version "2.4.0"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.4.1 Search vendor "Pidgin" for product "Pidgin" and version "2.4.1"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.4.2 Search vendor "Pidgin" for product "Pidgin" and version "2.4.2"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.4.3 Search vendor "Pidgin" for product "Pidgin" and version "2.4.3"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.5.0 Search vendor "Pidgin" for product "Pidgin" and version "2.5.0"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.5.1 Search vendor "Pidgin" for product "Pidgin" and version "2.5.1"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.5.2 Search vendor "Pidgin" for product "Pidgin" and version "2.5.2"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.5.3 Search vendor "Pidgin" for product "Pidgin" and version "2.5.3"		-		Affected
Pidgin Search vendor "Pidgin"		Pidgin Search vendor "Pidgin" for product "Pidgin"				2.5.4 Search vendor "Pidgin" for product "Pidgin" and version "2.5.4"		-		Affected