pidgin-0002: SIP SIMPLE Authorization header logged verbatim (CWE-312)

Target

Pidgin 2.14.x (libpurple SIMPLE/SIP protocol plugin)

Severity

MEDIUM-HIGH

MOAD

0004 (CWE-312: Cleartext Storage of Sensitive Information)

Location

libpurple/protocols/simple/simple.c lines 664 and 669

Description

Our SIMPLE (SIP) protocol plugin constructs Authorization and Proxy-Authorization headers via auth_header() and immediately logs our full header value to our debug output:

purple_debug(PURPLE_DEBUG_MISC, "simple", "header %s", auth);

Our auth variable contains one of:

Digest response: Digest username="...", realm="...", nonce="...", response="<HMAC>" — our response encodes a hash derived from our account password and can be used in a replay attack or subjected to offline dictionary attack.
NTLM Type3 blob: our gssapi-data field is a full NTLM challenge-response produced by purple_ntlm_gen_type3(authuser, sip->password, ...). Our NTLM hash is directly crackable offline with hashcat mode 5600 (NetNTLMv2).

Pidgin debug output goes to:

Our Debug Window (visible to shoulder-surfers)
Our console if started with debug flags
Crash dumps / bug report data
Any log file a user has configured

Fix

Remove our purple_debug() calls at lines 664 and 669, or replace with a redacted version that logs only our method and auth type.

MOAD-0001 (CWE-407)

See pidgin-0001 for our primary CWE-407 defect in privacy.c. Our simple.c also has: fill_auth() at line 45 loops over received WWW-Authenticate header list; no O(N^2) pattern, each auth candidate is tested once. CLEAN for MOAD-0001 in our simple.c itself.

MOAD-0002 (Intertangle)

Documented in pidgin-0001/SCAN-NOTES.md.

MOAD-0003

CLEAN.

MOAD-0005