[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20080708143954.GD376@linsec.ca>
Date: Tue, 8 Jul 2008 08:39:54 -0600
From: Vincent Danen <vdanen@...sec.ca>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE Request (pidgin)
* [2008-07-05 13:56:00 +0200] Nico Golde wrote:
>Hi Vincent,
>* Vincent Danen <vdanen@...sec.ca> [2008-07-03 21:42]:
>> * [2008-07-01 17:25:40 -0400] Steven M. Christey wrote:
>> >Name: CVE-2008-2957
>> >Status: Candidate
>> >URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2957
>> >Reference: MISC:http://crisp.cs.du.edu/?q=ca2007-1
>> >Reference: MLIST:[oss-security] 20080627 CVE Request (pidgin)
>> >Reference: URL:http://www.openwall.com/lists/oss-security/2008/06/27/3
>> >
>> >The UPnP functionality in Pidgin 2.0.0, and possibly other versions,
>> >allows remote attackers to trigger the download of arbitrary files and
>> >cause a denial of service (memory or disk consumption) via a UDP
>> >packet that specifies an arbitrary URL.
>>
>> There are patches with the original advisory for these two. Has anyone
>> had a chance to look at them to make sure they're ok? I don't see any
>> references to any of these issues on the pidgin website and no vendors
>> have issued pidgin updates for these that I can see, so I'm wondering if
>> anyone has looked at these patches (be it vendors or upstream) to
>> determine whether or not they're sufficient and/or suitable to apply to
>> a security update.
>
>I just had a look at http://crisp.cs.du.edu/crisp-files/pidgin-2.0.0-upnp-limit-download.diff
>to fix CVE-2008-2957. I think the patch itself is fine
>however I am not sure if this is the right way to fix the
>issue cause I basically just workarounds the problem by
>limiting the downloads triggered by UPnP (128k) without
>giving any way to reconfigure this value or to switch it off
>completely. This may be the reason why there isn't yet an
>official patch by the pidgin people.
>
>If you want to go with that simple workaround the patch is
>just fine.
Thanks for looking at it, Nico. I think the consensus of the Pidgin
developers is that neither issue is very serious, which I think is
another reason why it hasn't been fixed upstream yet. I think that I'm
going to do is just wait for them to fix it upstream before fixing
anything (if they determine it isn't really a vulnerability, then I'd
rather not waste my time fixing something that isn't really an issue).
--
Vincent Danen @ http://linsec.ca/
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
