[RedHat] Mehrere Schwachstellen in Pidgin vor Version 2.6.3 - RHSA-2009:1536-01

WiN Site Security Contacts win-sec-ssc at lists.dfn-cert.de
Mo Nov 2 12:34:45 CET 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Liebe Kolleginnen und Kollegen,

soeben erreichte uns nachfolgendes RedHat Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.

CVE-2009-2703 - Null Pointer Referenzierung im IRC Plugin der Bibliothek
libpurple

  Im IRC Plugin der Bibliothek libpurple laesst sich durch eine TOPIC
  Nachricht ohne Topic String die Referenzierung eines Null Pointers
  ausloesen, was zum Absturz des Programms fuehrt, das die Bibliothek
  benutzt. Ein entfernter Angreifer kann diese Schwachstelle zu einem
  Denial of Service Angriff ausnutzen.

CVE-2009-3615 - Schwachstelle im OSCAR Protokoll Plugin der Bibliothek
libpurple

  Im OSCAR Protokoll Plugin der Bibliothek libpurple werden Daten aus
  der Kontaktliste nicht ausreichend ueberprueft, was zur Derefernzierung
  eines ungueltigen Zeigers fuehrt. Ein entfernter Angreifer kann diese
  Schwachstelle dazu ausnutzen, das Programm zum Absturz zu bringen,
  welches die Bibliothek verwendet, z.B. Pidgin (Denial of Service).

CVE-2009-3083 - Null Pointer Referenzierung im MSN Plugin der Bibliothek
libpurple

  Im Msn Plugin der Bibliothek libpurple laesst sich durch eine SLP
  Invite Nachricht die Referenzierung eines Null Pointers ausloesen,
  falls eines der vorgeschriebenen Felder nicht vorhanden ist. Ein
  entfernter Angreifer kann diese Schwachstelle dazu ausnutzen, das
  Programm welches die Bibliothek verwendet, zum Absturz zu bringen
  (Denial of Service).

Betroffen sind die folgenden Software Pakete und Plattformen:

  Paket pidgin

  Red Hat Desktop version 3 - i386, x86_64
  Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x,
  x86_64
  Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
  Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
  RHEL Desktop Workstation (v. 5 client) - i386, x86_64
  RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
  Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, x86_64
  Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
  Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
  Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
  Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.

Hersteller Advisory:
  https://rhn.redhat.com/errata/RHSA-2009-1535.html
  https://rhn.redhat.com/errata/RHSA-2009-1536.html


(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.

Mit freundlichen Gruessen,
		Klaus Moeller, DFN-CERT

- -- 
Dipl. Inform. Klaus Moeller (Incident Response Team)
Phone: +49 40 808077-555, Fax: +49 40 808077-556

DFN-CERT Services GmbH, https://www.dfn-cert.de,  Phone  +49 40 808077-555
Sitz / Register: Hamburg, AG Hamburg, HRB 88805,  Ust-IdNr.:  DE 232129737
Sachsenstrase 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: pidgin security update
Advisory ID:       RHSA-2009:1536-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1536.html
Issue date:        2009-10-29
CVE Names:         CVE-2009-3615 
=====================================================================

1. Summary:

Updated pidgin packages that fix a security issue are now available for Red
Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously. The AOL
Open System for Communication in Realtime (OSCAR) protocol is used by the
AOL ICQ and AIM instant messaging systems.

An invalid pointer dereference bug was found in the way the Pidgin OSCAR
protocol implementation processed lists of contacts. A remote attacker
could send a specially-crafted contact list to a user running Pidgin,
causing Pidgin to crash. (CVE-2009-3615)

These packages upgrade Pidgin to version 2.6.3. Refer to the Pidgin release
notes for a full list of changes: http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users should upgrade to these updated packages, which correct
this issue. Pidgin must be restarted for this update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

529357 - CVE-2009-3615 Pidgin: Invalid pointer dereference (crash) after receiving contacts from SIM IM client

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/pidgin-2.6.3-2.el4.src.rpm

i386:
finch-2.6.3-2.el4.i386.rpm
finch-devel-2.6.3-2.el4.i386.rpm
libpurple-2.6.3-2.el4.i386.rpm
libpurple-devel-2.6.3-2.el4.i386.rpm
libpurple-perl-2.6.3-2.el4.i386.rpm
libpurple-tcl-2.6.3-2.el4.i386.rpm
pidgin-2.6.3-2.el4.i386.rpm
pidgin-debuginfo-2.6.3-2.el4.i386.rpm
pidgin-devel-2.6.3-2.el4.i386.rpm
pidgin-perl-2.6.3-2.el4.i386.rpm

ia64:
finch-2.6.3-2.el4.ia64.rpm
finch-devel-2.6.3-2.el4.ia64.rpm
libpurple-2.6.3-2.el4.ia64.rpm
libpurple-devel-2.6.3-2.el4.ia64.rpm
libpurple-perl-2.6.3-2.el4.ia64.rpm
libpurple-tcl-2.6.3-2.el4.ia64.rpm
pidgin-2.6.3-2.el4.ia64.rpm
pidgin-debuginfo-2.6.3-2.el4.ia64.rpm
pidgin-devel-2.6.3-2.el4.ia64.rpm
pidgin-perl-2.6.3-2.el4.ia64.rpm

ppc:
finch-2.6.3-2.el4.ppc.rpm
finch-devel-2.6.3-2.el4.ppc.rpm
libpurple-2.6.3-2.el4.ppc.rpm
libpurple-devel-2.6.3-2.el4.ppc.rpm
libpurple-perl-2.6.3-2.el4.ppc.rpm
libpurple-tcl-2.6.3-2.el4.ppc.rpm
pidgin-2.6.3-2.el4.ppc.rpm
pidgin-debuginfo-2.6.3-2.el4.ppc.rpm
pidgin-devel-2.6.3-2.el4.ppc.rpm
pidgin-perl-2.6.3-2.el4.ppc.rpm

x86_64:
finch-2.6.3-2.el4.x86_64.rpm
finch-devel-2.6.3-2.el4.x86_64.rpm
libpurple-2.6.3-2.el4.x86_64.rpm
libpurple-devel-2.6.3-2.el4.x86_64.rpm
libpurple-perl-2.6.3-2.el4.x86_64.rpm
libpurple-tcl-2.6.3-2.el4.x86_64.rpm
pidgin-2.6.3-2.el4.x86_64.rpm
pidgin-debuginfo-2.6.3-2.el4.x86_64.rpm
pidgin-devel-2.6.3-2.el4.x86_64.rpm
pidgin-perl-2.6.3-2.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/pidgin-2.6.3-2.el4.src.rpm

i386:
finch-2.6.3-2.el4.i386.rpm
finch-devel-2.6.3-2.el4.i386.rpm
libpurple-2.6.3-2.el4.i386.rpm
libpurple-devel-2.6.3-2.el4.i386.rpm
libpurple-perl-2.6.3-2.el4.i386.rpm
libpurple-tcl-2.6.3-2.el4.i386.rpm
pidgin-2.6.3-2.el4.i386.rpm
pidgin-debuginfo-2.6.3-2.el4.i386.rpm
pidgin-devel-2.6.3-2.el4.i386.rpm
pidgin-perl-2.6.3-2.el4.i386.rpm

x86_64:
finch-2.6.3-2.el4.x86_64.rpm
finch-devel-2.6.3-2.el4.x86_64.rpm
libpurple-2.6.3-2.el4.x86_64.rpm
libpurple-devel-2.6.3-2.el4.x86_64.rpm
libpurple-perl-2.6.3-2.el4.x86_64.rpm
libpurple-tcl-2.6.3-2.el4.x86_64.rpm
pidgin-2.6.3-2.el4.x86_64.rpm
pidgin-debuginfo-2.6.3-2.el4.x86_64.rpm
pidgin-devel-2.6.3-2.el4.x86_64.rpm
pidgin-perl-2.6.3-2.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/pidgin-2.6.3-2.el4.src.rpm

i386:
finch-2.6.3-2.el4.i386.rpm
finch-devel-2.6.3-2.el4.i386.rpm
libpurple-2.6.3-2.el4.i386.rpm
libpurple-devel-2.6.3-2.el4.i386.rpm
libpurple-perl-2.6.3-2.el4.i386.rpm
libpurple-tcl-2.6.3-2.el4.i386.rpm
pidgin-2.6.3-2.el4.i386.rpm
pidgin-debuginfo-2.6.3-2.el4.i386.rpm
pidgin-devel-2.6.3-2.el4.i386.rpm
pidgin-perl-2.6.3-2.el4.i386.rpm

ia64:
finch-2.6.3-2.el4.ia64.rpm
finch-devel-2.6.3-2.el4.ia64.rpm
libpurple-2.6.3-2.el4.ia64.rpm
libpurple-devel-2.6.3-2.el4.ia64.rpm
libpurple-perl-2.6.3-2.el4.ia64.rpm
libpurple-tcl-2.6.3-2.el4.ia64.rpm
pidgin-2.6.3-2.el4.ia64.rpm
pidgin-debuginfo-2.6.3-2.el4.ia64.rpm
pidgin-devel-2.6.3-2.el4.ia64.rpm
pidgin-perl-2.6.3-2.el4.ia64.rpm

x86_64:
finch-2.6.3-2.el4.x86_64.rpm
finch-devel-2.6.3-2.el4.x86_64.rpm
libpurple-2.6.3-2.el4.x86_64.rpm
libpurple-devel-2.6.3-2.el4.x86_64.rpm
libpurple-perl-2.6.3-2.el4.x86_64.rpm
libpurple-tcl-2.6.3-2.el4.x86_64.rpm
pidgin-2.6.3-2.el4.x86_64.rpm
pidgin-debuginfo-2.6.3-2.el4.x86_64.rpm
pidgin-devel-2.6.3-2.el4.x86_64.rpm
pidgin-perl-2.6.3-2.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/pidgin-2.6.3-2.el4.src.rpm

i386:
finch-2.6.3-2.el4.i386.rpm
finch-devel-2.6.3-2.el4.i386.rpm
libpurple-2.6.3-2.el4.i386.rpm
libpurple-devel-2.6.3-2.el4.i386.rpm
libpurple-perl-2.6.3-2.el4.i386.rpm
libpurple-tcl-2.6.3-2.el4.i386.rpm
pidgin-2.6.3-2.el4.i386.rpm
pidgin-debuginfo-2.6.3-2.el4.i386.rpm
pidgin-devel-2.6.3-2.el4.i386.rpm
pidgin-perl-2.6.3-2.el4.i386.rpm

ia64:
finch-2.6.3-2.el4.ia64.rpm
finch-devel-2.6.3-2.el4.ia64.rpm
libpurple-2.6.3-2.el4.ia64.rpm
libpurple-devel-2.6.3-2.el4.ia64.rpm
libpurple-perl-2.6.3-2.el4.ia64.rpm
libpurple-tcl-2.6.3-2.el4.ia64.rpm
pidgin-2.6.3-2.el4.ia64.rpm
pidgin-debuginfo-2.6.3-2.el4.ia64.rpm
pidgin-devel-2.6.3-2.el4.ia64.rpm
pidgin-perl-2.6.3-2.el4.ia64.rpm

x86_64:
finch-2.6.3-2.el4.x86_64.rpm
finch-devel-2.6.3-2.el4.x86_64.rpm
libpurple-2.6.3-2.el4.x86_64.rpm
libpurple-devel-2.6.3-2.el4.x86_64.rpm
libpurple-perl-2.6.3-2.el4.x86_64.rpm
libpurple-tcl-2.6.3-2.el4.x86_64.rpm
pidgin-2.6.3-2.el4.x86_64.rpm
pidgin-debuginfo-2.6.3-2.el4.x86_64.rpm
pidgin-devel-2.6.3-2.el4.x86_64.rpm
pidgin-perl-2.6.3-2.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pidgin-2.6.3-2.el5.src.rpm

i386:
finch-2.6.3-2.el5.i386.rpm
libpurple-2.6.3-2.el5.i386.rpm
libpurple-perl-2.6.3-2.el5.i386.rpm
libpurple-tcl-2.6.3-2.el5.i386.rpm
pidgin-2.6.3-2.el5.i386.rpm
pidgin-debuginfo-2.6.3-2.el5.i386.rpm
pidgin-perl-2.6.3-2.el5.i386.rpm

x86_64:
finch-2.6.3-2.el5.i386.rpm
finch-2.6.3-2.el5.x86_64.rpm
libpurple-2.6.3-2.el5.i386.rpm
libpurple-2.6.3-2.el5.x86_64.rpm
libpurple-perl-2.6.3-2.el5.x86_64.rpm
libpurple-tcl-2.6.3-2.el5.x86_64.rpm
pidgin-2.6.3-2.el5.i386.rpm
pidgin-2.6.3-2.el5.x86_64.rpm
pidgin-debuginfo-2.6.3-2.el5.i386.rpm
pidgin-debuginfo-2.6.3-2.el5.x86_64.rpm
pidgin-perl-2.6.3-2.el5.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pidgin-2.6.3-2.el5.src.rpm

i386:
finch-devel-2.6.3-2.el5.i386.rpm
libpurple-devel-2.6.3-2.el5.i386.rpm
pidgin-debuginfo-2.6.3-2.el5.i386.rpm
pidgin-devel-2.6.3-2.el5.i386.rpm

x86_64:
finch-devel-2.6.3-2.el5.i386.rpm
finch-devel-2.6.3-2.el5.x86_64.rpm
libpurple-devel-2.6.3-2.el5.i386.rpm
libpurple-devel-2.6.3-2.el5.x86_64.rpm
pidgin-debuginfo-2.6.3-2.el5.i386.rpm
pidgin-debuginfo-2.6.3-2.el5.x86_64.rpm
pidgin-devel-2.6.3-2.el5.i386.rpm
pidgin-devel-2.6.3-2.el5.x86_64.rpm

RHEL Optional Productivity Applications (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pidgin-2.6.3-2.el5.src.rpm

i386:
finch-2.6.3-2.el5.i386.rpm
finch-devel-2.6.3-2.el5.i386.rpm
libpurple-2.6.3-2.el5.i386.rpm
libpurple-devel-2.6.3-2.el5.i386.rpm
libpurple-perl-2.6.3-2.el5.i386.rpm
libpurple-tcl-2.6.3-2.el5.i386.rpm
pidgin-2.6.3-2.el5.i386.rpm
pidgin-debuginfo-2.6.3-2.el5.i386.rpm
pidgin-devel-2.6.3-2.el5.i386.rpm
pidgin-perl-2.6.3-2.el5.i386.rpm

x86_64:
finch-2.6.3-2.el5.i386.rpm
finch-2.6.3-2.el5.x86_64.rpm
finch-devel-2.6.3-2.el5.i386.rpm
finch-devel-2.6.3-2.el5.x86_64.rpm
libpurple-2.6.3-2.el5.i386.rpm
libpurple-2.6.3-2.el5.x86_64.rpm
libpurple-devel-2.6.3-2.el5.i386.rpm
libpurple-devel-2.6.3-2.el5.x86_64.rpm
libpurple-perl-2.6.3-2.el5.x86_64.rpm
libpurple-tcl-2.6.3-2.el5.x86_64.rpm
pidgin-2.6.3-2.el5.i386.rpm
pidgin-2.6.3-2.el5.x86_64.rpm
pidgin-debuginfo-2.6.3-2.el5.i386.rpm
pidgin-debuginfo-2.6.3-2.el5.x86_64.rpm
pidgin-devel-2.6.3-2.el5.i386.rpm
pidgin-devel-2.6.3-2.el5.x86_64.rpm
pidgin-perl-2.6.3-2.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3615
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFK6allXlSAg2UNWIIRAkAKAJ9Nj5F13lc9+yi9UL9Wm/Dw4DAVpwCfVqQE
88xBuQhXhZRY0JOWOO5lBic=
=Lj/Y
- -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFK7sPVk0kIxZMiiQ8RAkDTAJ4h+28oQyBBqa9o6IwbBuGjT4NhNQCgo7LG
XboaIJB4hj0Rk/58IKEqVkk=
=OQAM
-----END PGP SIGNATURE-----