-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jann Horn wrote: > 2012/2/25 Dimitris Glynos <dimitris@xxxxxxxxxxxxxxx>: >> Pidgin transmits OTR (off-the-record) conversations over DBUS in >> plaintext. This makes it possible for attackers that have gained >> user-level access on a host, to listen in on private conversations >> associated with the victim account. > > Basically, you're saying that if I have the rights of a user on a > machine, I can access the private conversations of that user? Ooooh > no. Well, I can also copy his keyfiles, no? And I can alter his > settings. And spawn fake "Update didn't work, please enter root > password to proceed" windows. I could alter his ~/.bashrc so that > whenever he launches "sudo" or "su", a script is launched instead > that grabs his password. So, please, what's the point? I think you didn't understood the content of the advisory. If there are 10 non-root users in an Ubuntu machine for example, if user 1 is using pidgin with OTR compiled with DBUS, then user 2 to 10 can see what user 1 pidgin conversation. "Simple" as that, without impersonating user 1 or knowing his password. Cheers antisnatchor > > _______________________________________________ Full-Disclosure - We > believe in it. Charter: > http://lists.grok.org.uk/full-disclosure-charter.html Hosted and > sponsored by Secunia - http://secunia.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPS9tfAAoJEBgl8Z+oSxe4fv8IAIHrER/TssgDxUmQrpcs11Ud eYdxLG897aa7plBwi8bABSVR/0moO4cH0w3dvcgIYJ1kSlxiy6NLqlGi9SF6biAx Yw4uDDeaQggO9CMS8FX/Dn8JNhZUxQ47C0M4hydd8Irg5FPPUBRDcXkcH5MjI35v GcbSx2MEN5YrSvn4C6z2M3MJcuyhROlWfsa68cBc3EVIe4CjWTK1NLxCidXLrn8V aXtGOpnrXZPoJeNjhCQGvhnAUMdn2W5PQjF24f6hzqb8vHkF7Y0ZunD9IxoWhnMU sNGCcUNAEEDXfGUV6LtkwZOP1l6W7bZTRNqT7C8Jsp/K4Pfbit+ALXIhIlQZCds= =zebT -----END PGP SIGNATURE-----
