Vulnerability Description
Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adium | Adium | 1.3.8 |
| Pidgin | Pidgin | 2.6.4 |
| Fedoraproject | Fedora | 11 |
| Opensuse | Opensuse | >= 11.0, <= 11.2 |
| Suse | Linux Enterprise | 11.0 |
| Suse | Linux Enterprise Server | 10 |
| Redhat | Enterprise Linux | 4.0 |
Related Weaknesses (CWE)
References
- http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae546Broken Link
- http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92Broken Link
- http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b81Broken Link
- http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05fBroken Link
- http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.htmlProduct
- http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033771.htMailing List
- http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033848.htMailing List
- http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htmlMailing List
- http://secunia.com/advisories/37953Broken LinkVendor Advisory
- http://secunia.com/advisories/37954Broken LinkVendor Advisory
- http://secunia.com/advisories/37961Broken Link
- http://secunia.com/advisories/38915Broken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-277450-1Broken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1022203.1-1Broken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:085Broken Link
FAQ
What is CVE-2010-0013?
CVE-2010-0013 is a vulnerability with a CVSS score of 7.5 (HIGH). Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/...
How severe is CVE-2010-0013?
CVE-2010-0013 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-0013?
Check the references section above for vendor advisories and patch information. Affected products include: Adium Adium, Pidgin Pidgin, Fedoraproject Fedora, Opensuse Opensuse, Suse Linux Enterprise.