CVE-2009-1889: Medium severity Pidgin Pidgin vulnerability
An out-of-memory denial of service flaw was found in the Pidgin's Open System for CommunicAtion in Realtime (OSCAR) protocol implementation. If a remote ICQ user sent a web message to the local Pidgin user using this protocol, it would lead to excessive memory allocation and denial of service (Pidgin crash).
References: http://developer.pidgin.im/ticket/9483 http://pidgin.im/pipermail/devel/2009-May/008227.html
Other sources
The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1889?
The severity of CVE-2009-1889 is classified as a denial of service vulnerability.
How do I fix CVE-2009-1889?
To fix CVE-2009-1889, upgrade to a version of Pidgin that is not affected by this vulnerability, specifically versions above 2.5.7.
Which versions of Pidgin are vulnerable to CVE-2009-1889?
Pidgin versions 2.1.0 to 2.5.7 are vulnerable to CVE-2009-1889.
What causes the denial of service in CVE-2009-1889?
The denial of service in CVE-2009-1889 is caused by excessive memory allocation triggered by web messages from remote ICQ users.
Is there a workaround for CVE-2009-1889?
A workaround for CVE-2009-1889 is to avoid receiving messages from ICQ users until a fix is applied.