Adium 1.5.10.2 libpurple Code Execution

2017.03.21
Credit: Eryt
Risk: High
Local: No
Remote: Yes
CWE: CWE-787


Ogólna skala CVSS: 7.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

Adium is a popular instant messaging client for MacOS (OSX) that incorporates libpurple. The current release (1.5.10.2) is vulnerable to CVE-2017-2640 in libpurple, which permits execution of arbitrary code on the client. The Adium team has been aware of the vulnerability since at least March 15, but has not released an advisory to its users, for reasons unknown. A post to the official developer's mailing list, which included vulnerability information and queries about Adium's process for handling upstream advisories from libpurple, has gone unanswered. Adium's build process documentation does not seem to include steps for upgrading or rebuilding libpurple, and the copy of libpurple checked into Adium's open-source repository as a binary blob of unknown provenance. Eryt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top