bugtraq - Re: [Full-disclosure] pidgin OTR information leakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F4BDB60.6070205@gmail.com>
Date: Mon, 27 Feb 2012 20:37:04 +0100
From: Michele Orru <antisnatchor@...il.com>
To: Jann Horn <jannhorn@...glemail.com>
CC: Dimitris Glynos <dimitris@...sus-labs.com>,
  full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: [Full-disclosure] pidgin OTR information leakage

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Jann Horn wrote:
> 2012/2/25 Dimitris Glynos <dimitris@...sus-labs.com>:
>> Pidgin transmits OTR (off-the-record) conversations over DBUS in 
>> plaintext. This makes it possible for attackers that have gained 
>> user-level access on a host, to listen in on private conversations 
>> associated with the victim account.
> 
> Basically, you're saying that if I have the rights of a user on a 
> machine, I can access the private conversations of that user? Ooooh 
> no. Well, I can also copy his keyfiles, no? And I can alter his 
> settings. And spawn fake "Update didn't work, please enter root 
> password to proceed" windows. I could alter his ~/.bashrc so that 
> whenever he launches "sudo" or "su", a script is launched instead
> that grabs his password. So, please, what's the point?

I think you didn't understood the content of the advisory.
If there are 10 non-root users in an Ubuntu machine for example,
if user 1 is using pidgin with OTR compiled with DBUS, then user 2 to 10
can see what user 1 pidgin conversation.

"Simple" as that, without impersonating user 1 or knowing his password.

Cheers
antisnatchor

> 
> _______________________________________________ Full-Disclosure - We
> believe in it. Charter:
> http://lists.grok.org.uk/full-disclosure-charter.html Hosted and
> sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPS9tfAAoJEBgl8Z+oSxe4fv8IAIHrER/TssgDxUmQrpcs11Ud
eYdxLG897aa7plBwi8bABSVR/0moO4cH0w3dvcgIYJ1kSlxiy6NLqlGi9SF6biAx
Yw4uDDeaQggO9CMS8FX/Dn8JNhZUxQ47C0M4hydd8Irg5FPPUBRDcXkcH5MjI35v
GcbSx2MEN5YrSvn4C6z2M3MJcuyhROlWfsa68cBc3EVIe4CjWTK1NLxCidXLrn8V
aXtGOpnrXZPoJeNjhCQGvhnAUMdn2W5PQjF24f6hzqb8vHkF7Y0ZunD9IxoWhnMU
sNGCcUNAEEDXfGUV6LtkwZOP1l6W7bZTRNqT7C8Jsp/K4Pfbit+ALXIhIlQZCds=
=zebT
-----END PGP SIGNATURE-----