full-disclosure - [FD] Adium vulnerable to remote code execution via libpurple

Open Source and information security mailing list archives

Message-ID: <CAHM5Z6w-VcQuZfXt5ZnQ63L4649jG=JDpZzLXj4z36+sex_QmA@mail.gmail.com>
Date: Mon, 20 Mar 2017 23:00:08 -0400
From: erythronium23 <erythronium23@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Adium vulnerable to remote code execution via libpurple

Adium is a popular instant messaging client for MacOS (OSX) that
incorporates libpurple. The current release (1.5.10.2) is vulnerable
to CVE-2017-2640 in libpurple, which permits execution of arbitrary
code on the client.

The Adium team has been aware of the vulnerability since at least
March 15, but has not released an advisory to its users, for reasons
unknown.

A post to the official developer's mailing list, which included
vulnerability information and queries about Adium's process for
handling upstream advisories from libpurple, has gone unanswered.
Adium's build process documentation does not seem to include steps for
upgrading or rebuilding libpurple, and the copy of libpurple checked
into Adium's open-source repository as a binary blob of unknown
provenance.

Eryt

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives