mailing list archives
Re: [Full-disclosure] pidgin OTR information leakage
From: Michele Orru <antisnatchor () gmail com>
Date: Mon, 27 Feb 2012 20:37:04 +0100
-----BEGIN PGP SIGNED MESSAGE-----
Jann Horn wrote:
2012/2/25 Dimitris Glynos <dimitris () census-labs com>:
Pidgin transmits OTR (off-the-record) conversations over DBUS in
plaintext. This makes it possible for attackers that have gained
user-level access on a host, to listen in on private conversations
associated with the victim account.
Basically, you're saying that if I have the rights of a user on a
machine, I can access the private conversations of that user? Ooooh
no. Well, I can also copy his keyfiles, no? And I can alter his
settings. And spawn fake "Update didn't work, please enter root
password to proceed" windows. I could alter his ~/.bashrc so that
whenever he launches "sudo" or "su", a script is launched instead
that grabs his password. So, please, what's the point?
I think you didn't understood the content of the advisory.
If there are 10 non-root users in an Ubuntu machine for example,
if user 1 is using pidgin with OTR compiled with DBUS, then user 2 to 10
can see what user 1 pidgin conversation.
"Simple" as that, without impersonating user 1 or knowing his password.
_______________________________________________ Full-Disclosure - We
believe in it. Charter:
http://lists.grok.org.uk/full-disclosure-charter.html Hosted and
sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----