CVE-2009-2694: Input Validation
Core Security Technologies reported that previous upstream fixes addressing insufficient input validation flaw in pidgin / libpurple in function msnslplinkprocessmsg() are inefficient and can be bypassed. This flaw allows an attacker to overwrite pidgin's memory and possibly execute arbitrary code with the privileges of the user running application using libpurple.
This issue was previously tracked as CVE-2008-2927 (bug #453764) and CVE-2009-1376 (bug #500493, incomplete fix).
Other sources
The msnslplinkprocessmsg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.
— Red Hat
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2694?
CVE-2009-2694 has a severity rating that indicates it allows remote attackers to potentially execute arbitrary code or cause a denial of service.
How do I fix CVE-2009-2694?
To fix CVE-2009-2694, you should upgrade to the versions of Pidgin or Adium that contain patches for this vulnerability, specifically versions 2.5.9 or later for Pidgin and 1.3.6 or later for Adium.
Which software is affected by CVE-2009-2694?
CVE-2009-2694 affects versions of Pidgin before 2.5.9 and Adium before 1.3.5.
What type of attack is possible with CVE-2009-2694?
CVE-2009-2694 allows attackers to send specially crafted messages that can lead to memory corruption and application crashes.
Is it safe to use older versions of Pidgin or Adium due to CVE-2009-2694?
Using older versions of Pidgin or Adium that are affected by CVE-2009-2694 poses a significant security risk and should be avoided.