Note: This is an archival copy of Security Sun Alert 272489 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1021575.1.
Solaris 10 Operating System
Date of Workaround Release
Date of Resolved Release
Security vulnerability in the OSCAR protocol plugin for pidgin(1):
A security vulnerability in the the OSCAR protocol plugin library, the shared library that adds support for various instant messaging networks to the pidgin(1) Instant Messaging client (previously known as Gaim), may allow remote unprivileged users to cause a Denial of Service (DoS) through an application crash via crafted contact-list data for (1) ICQ and possibly (2) AIM.
This issue is also referenced in the following document:
CVE-2009-3615 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3615
2. Contributing Factors
This issue can occur in the following releases:
Note 2: This issue only affects systems that have affected versions of either the Pidgin IM client installed or the Gaim IM client installed.
To determine if either of these are installed, run the following commands:
$ /usr/bin/pidgin -v || echo "Pidgin IM client not installed"All versions of Pidgin before 2.6.3, and all versions of Gaim after 0.78 are impacted by this issue.
The conversion from Gaim to Pidgin occurred in build snv_68 of OpenSolaris and in Solaris 10 patches 119548-11 (for SPARC) and 119549-11 (for x86).
Note 3: OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived.
To determine the base build of OpenSolaris, the following command can be used:
$ uname -v3. Symptoms
If the described issue has been exploited to cause a Denial of Service (DoS), Pidgin will crash, potentially leaving a core file depending on the system configuration. There are no predictable symptoms that would indicate that this issue has been exploited to execute arbitrary code.
To work around this issue until the resolution patches can be applied, do not import contact lists from untrusted sources.
This issue is addressed in the following releases:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2010 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
11-Jan-2009: Updated Contributing Factors and Resolution sections. Resolved.
This solution has no attachment