Remote SHELL Command Injection Vulnerability in the Pidgin pidgin-knotify plug-in

Release date: 2010-09-12
Updated on:

Affected Systems:
Pidgin-knottpidgin-knotty0.2.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 43206
Cve id: CVE-2010-3088

Pidgin-knotting is the Pidgin Event Notification plug-in used in the KDE 4 environment.

The systy function in the pidgin-knotify.c file of the pidgin-knotify plug-in lacks input filtering, allowing remote attackers to inject and execute arbitrary commands by including malicious shell metacharacters in messages. The following are vulnerable code snippets in src/pidgin-knotify.c file:

Command = g_strdup_printf ("kdialog -- title '% s' -- passivepopup' % s' % d", title,
Body, timeout );
[...]
Result = system (command );

<* Source: Matthias Petschick

Link: http://secunia.com/advisories/41382/
Https://bugs.gentoo.org/show_bug.cgi? Format = multiple & amp; id = 336916
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Pidgin-knotted
--------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://code.google.com/p/pidgin-knotify/issues/detail? Id = 1