Bypassing MassLogger Anti-Analysis — a Man-in-the-Middle Approach

The FireEye Front Line Applied Research & Expertise FLARE Team attempts to always stay on top of the most current and emerging threats. As a member of the FLARE Reverse Engineer team, I recently received a request to analyze a fairly new credential stealer identified as MassLogger. Despite the la...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. An input sanitization flaw was found in the way the Pidgin SILC Secure Internet Live Conferencing protocol plug-in escaped certain UTF-8 characters in channel messages. A remote attacker could use this flaw to crash Pidgin via a specially-crafted SILC...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. An input sanitization flaw was found in the way the AOL Open System for Communication in Realtime OSCAR protocol plug-in in Pidgin, used by the AOL ICQ and AIM instant messaging systems, escaped certain UTF-8 characters. A remote attacker could use this...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. Multiple NULL pointer dereference flaws were found in the Jingle extension of the Extensible Messaging and Presence Protocol XMPP protocol plug-in in Pidgin. A remote attacker could use these flaws to crash Pidgin via a specially-crafted Jingle multimedi...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service DoS. The vulnerability exists as an input sanitization flaw was found in the way the Pidgin SILC Secure Internet Live Conferencing protocol plug-in escaped certain UTF-8 characters. A remote attacker could use this flaw to crash Pidgin via a...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service DoS. The vulnerability exists as multiple NULL pointer dereference flaws were found in the way the Pidgin Yahoo! Messenger Protocol plug-in handled malformed YMSG packets. A remote attacker could use these flaws to crash Pidgin via a specially-crafted...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. A NULL pointer dereference flaw was found in the way the Pidgin MSN protocol plug-in processed custom emoticon messages. A remote attacker could use this flaw to crash Pidgin by sending specially-crafted emoticon messages during mutual communication...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. Multiple NULL pointer dereference flaws were found in the way Pidgin handled Base64 decoding. A remote attacker could use these flaws to crash Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol, MSN, MySpace, or Extensible Messaging...

Directory Traversal

pidgin is vulnerable to directory traversal. The vulnerability exists as a remote attacker could send a specially-crafted emoticon image download request that would cause Pidgin to disclose an arbitrary file readable to the user running Pidgin...

Arbitrary Code Execution

pidgin is vulnerable to arbitrary code execution. If a user received a malicious MSN message, it was possible to execute arbitrary code with the permissions of the user running Pidgin...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. A remote attacker could flood the victim with emoticon images during mutual communication, leading to excessive CPU use...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. A denial of service flaw was found in Finch's XMPP chat implementation, when using multi-user chat. If a Finch user in a multi-user chat session were to change their nickname to contain the HTML "br" element, it would cause Finch to crash...

Denial Of Service (DoS)

Pidgin is vulnerable to Denial of Service DoS.An input sanitization flaw was found in the way Pidgin's MSN protocol implementation handled MSNSLP invitations. A remote attacker could send a specially-crafted INVITE request that would cause a denial of service memory corruption and Pidgin crash...

Denial Of Service (DoS)

Pidgin is vulnerable Denial of Service DoS. An invalid pointer dereference bug was found in the way the Pidgin OSCAR protocol implementation processed lists of contacts. A remote attacker could send a specially-crafted contact list to a user running Pidgin, causing Pidgin to crash...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. A NULL pointer dereference flaw was found in the way the Pidgin XMPP protocol plug-in processes IQ error responses when trying to fetch a custom smiley. A remote client could send a specially-crafted IQ error response that would crash Pidgin...

Denial Of Service (DoS)

Pidgin is vulnerable to Denial of Service DoS. A NULL pointer dereference flaw was found in the way the Pidgin MSN protocol plug-in handles improper MSNSLP invitations. A remote attacker could send a specially-crafted MSNSLP invitation request, which once accepted by a valid Pidgin user, would le...

Information Disclosure

pidgin is vulnerable to information disclosure. It was discovered that, when connecting to certain, very old Jabber servers via XMPP, Pidgin may ignore the "Require SSL/TLS" setting. In these situations, a non-encrypted connection is established rather than the connection failing, causing the use...

Denial Of Service (DoS)

Pidgin is vulnerable to Denial of Service DoS. A NULL pointer dereference flaw was found in the way the Pidgin IRC protocol plug-in handles IRC topics. A malicious IRC server could send a specially-crafted IRC TOPIC message, which once received by Pidgin, would lead to a denial of service Pidgin...

Arbitrary Code Execution

pidgin is vulnerable to arbitrary code execution. The vulnerability exists as it was discovered that on 32-bit platforms, the Red Hat Security Advisory RHSA-2008:0584 provided an incomplete fix for the integer overflow flaw affecting Pidgin's MSN protocol handler. If a Pidgin client receives a...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service DoS. The vulnerability exists as a flaw was found in the way Pidgin's PurpleCircBuffer object is expanded. If the buffer is full when more data arrives, the data stored in this buffer becomes corrupted. This corrupted data could result in confusing or...