java-topology/defects/pidgin-0002/SCAN-NOTES.md

55 lines
1.8 KiB
Markdown

# pidgin-0002: SIP SIMPLE Authorization header logged verbatim (CWE-312)
## Target
Pidgin 2.14.x (libpurple SIMPLE/SIP protocol plugin)
## Severity
MEDIUM-HIGH
## MOAD
0004 (CWE-312: Cleartext Storage of Sensitive Information)
## Location
`libpurple/protocols/simple/simple.c` lines 664 and 669
## Description
Our SIMPLE (SIP) protocol plugin constructs `Authorization` and
`Proxy-Authorization` headers via `auth_header()` and immediately logs our
full header value to our debug output:
```c
purple_debug(PURPLE_DEBUG_MISC, "simple", "header %s", auth);
```
Our `auth` variable contains one of:
- **Digest response**: `Digest username="...", realm="...", nonce="...", response="<HMAC>"` — our response
encodes a hash derived from our account password and can be used in a replay attack
or subjected to offline dictionary attack.
- **NTLM Type3 blob**: our gssapi-data field is a full NTLM challenge-response
produced by `purple_ntlm_gen_type3(authuser, sip->password, ...)`. Our
NTLM hash is directly crackable offline with hashcat mode 5600 (NetNTLMv2).
Pidgin debug output goes to:
1. Our Debug Window (visible to shoulder-surfers)
2. Our console if started with debug flags
3. Crash dumps / bug report data
4. Any log file a user has configured
## Fix
Remove our `purple_debug()` calls at lines 664 and 669, or replace with
a redacted version that logs only our method and auth type.
## MOAD-0001 (CWE-407)
See `pidgin-0001` for our primary CWE-407 defect in `privacy.c`.
Our `simple.c` also has: `fill_auth()` at line 45 loops over received
`WWW-Authenticate` header list; no O(N^2) pattern, each auth candidate
is tested once. CLEAN for MOAD-0001 in our simple.c itself.
## MOAD-0002 (Intertangle)
Documented in `pidgin-0001/SCAN-NOTES.md`.
## MOAD-0003
CLEAN.
## MOAD-0005
CLEAN.