English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Pidgin MXit Message Parsing Buffer Overflow Vulnerability


Secunia ID

SA49831

CVE-ID

CVE-2012-3374

Release Date

06 Jul 2012

Criticality

Highly Critical

Solution Status

Vendor Patch

Software

Pidgin 2.x

Where

From remote

Impact
System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Description

A vulnerability has been reported in Pidgin, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error within the "mxit_show_message()" function (libpurple/protocols/mxit/markup.c) when parsing incoming messages containing inline images. This can be exploited to cause a stack-based buffer overflow via a specially crafted RX message.

Successful exploitation of the vulnerability may allow execution of arbitrary code.

The vulnerability is reported in versions prior to 2.10.5.

Solution

Update to version 2.10.5.

Reported by

The vendor credits Ulf Härnhammar.

Original Advisory

http://www.pidgin.im/news/security/index.php?id=64