Cloudanix VulnDB

CVE-2014-3775

None

CVSS

—

EPSS

3.8%

Published

May 22, 2014

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a chat library lets attackers who control a message server crash the program or take control of the computer by sending one specially made message.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper input validation in libgadu allows a remote Gadu-Gadu file relay server to supply a crafted message that triggers memory overwrite, enabling denial of service or arbitrary code execution.

Why it matters to the business

Compromised or spoofed relay servers can crash client applications or execute attacker code on user systems, leading to service disruption, data exposure, and potential full system compromise for organizations relying on affected chat clients.

How an attack unfolds

An attacker positions a malicious or compromised Gadu-Gadu file relay server in the network path, then sends a specially crafted message that the vulnerable libgadu library fails to validate, resulting in memory corruption that can be leveraged for code execution.

How to fix it

Upgrade libgadu to version 1.11.4 or later, or 1.12.0-rc3 or later. Rebuild and redeploy any dependent applications such as Pidgin that statically or dynamically link the library.

How to confirm the fix worked

Confirm the installed libgadu version is at least 1.11.4 or 1.12.0-rc3 by inspecting package metadata or build logs, then test that the client rejects or safely handles the previously crashing message format.

Typical attack path

  1. Identify or compromise a Gadu-Gadu file relay server reachable by target users
  2. Craft a malicious message exploiting the missing input validation
  3. Deliver the message through the relay server to the victim client
  4. Trigger memory overwrite leading to crash or code execution

How to detect it

Review application logs and crash reports from Pidgin or other libgadu-based clients for unexpected terminations or memory-related errors around the time of Gadu-Gadu relay communication; look for unusual relay server addresses in connection logs.

What your security team should do

  • Prioritize upgrade of libgadu and all dependent chat clients to patched releases
  • Scan internal software inventories for any remaining vulnerable libgadu versions
  • Monitor for unexpected crashes in messaging applications that may indicate attempted exploitation

The record

libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 libgadu 0 1:1.12.0~rc3-1
Debian:12 libgadu 0 1:1.12.0~rc3-1
Debian:13 libgadu 0 1:1.12.0~rc3-1
Debian:7 libgadu 0 1:1.11.2-1+deb7u2
Mageia:3 libgadu 0 1.11.4-1.mga3
Mageia:3 pidgin 0 2.10.9-1.1.mga3
Mageia:4 libgadu 0 1.11.4-1.mga4
Mageia:4 pidgin 0 2.10.9-1.1.mga4
Ubuntu:14.04:LTS pidgin 0 1:2.10.9-0ubuntu3.1

Related vulnerabilities