Уязвимость CVE-2010-0013: Информация

Описание

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

Важность: HIGH (7,5) Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Ссылки на рекомендации, решения и инструменты

1. Подверженные конфигурации:

   1. Конфигурация 1

      cpe:2.3:a:adium:adium:1.3.8:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:pidgin:pidgin:2.6.4:*:*:*:*:*:*:*

      ---

      Конфигурация 2

      cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*

      ---

      Конфигурация 3

      cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:-:*:*:*

      ---

      cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*

      ---

      cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:*

      ---

      cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*

      Start including

      11.0

      End including

      11.2

      ---

      Конфигурация 4

      cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*

      ---