BugTraq
pidgin OTR information leakage Feb 25 2012 04:31PM
Dimitris Glynos (dimitris census-labs com) (1 replies)
Re: pidgin OTR information leakage Feb 27 2012 05:27PM
Jann Horn (jannhorn googlemail com) (1 replies)
2012/2/25 Dimitris Glynos <dimitris (at) census-labs (dot) com [email concealed]>:
> Pidgin transmits OTR (off-the-record) conversations over DBUS in
> plaintext. This makes it possible for attackers that have gained
> user-level access on a host, to listen in on private conversations
> associated with the victim account.

Basically, you're saying that if I have the rights of a user on a
machine, I can access the private conversations of that user? Ooooh
no. Well, I can also copy his keyfiles, no? And I can alter his
settings. And spawn fake "Update didn't work, please enter root
password to proceed" windows. I could alter his ~/.bashrc so that
whenever he launches "sudo" or "su", a script is launched instead that
grabs his password. So, please, what's the point?

[ reply ]
Re: [Full-disclosure] pidgin OTR information leakage Feb 27 2012 07:37PM
Michele Orru (antisnatchor gmail com) (1 replies)
Re: [Full-disclosure] pidgin OTR information leakage Feb 27 2012 08:21PM
Rich Pieri (ratinox MIT EDU) (1 replies)
Re: [Full-disclosure] pidgin OTR information leakage Feb 27 2012 09:27PM
Jeffrey Walton (noloader gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus