NetSight
IP …
high7.5Public exploit code

CVE-2010-0013

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary fi…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

Affected products

VendorProductAffected versions
AdiumAdium
Version 1.3.8
PidginPidgin
Version 2.6.4
FedoraprojectFedora
Versions 11, 12
OpensuseOpensuse
from 11.0 through 11.2
SuseLinux Enterprise
Version 11.0
SuseLinux Enterprise Server
Version 10
RedhatEnterprise Linux
Versions 4.0, 5.0

Weakness classification

CWE-22

References