oss-security - Re: CVE request for bitlbee

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 8 Sep 2008 09:36:08 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: vmiklos@...galware.org, coley@...re.org
Subject: Re: CVE request for bitlbee

On Sat, 30 Aug 2008 01:24:14 +0200 Miklos Vajna
<vmiklos@...galware.org> wrote:

> bitlbee-1.2.2 is released, and it comes with a NULL pointer
> dereference fix, which allows people to hijack accounts.
> 
> More info:
> 
> http://bitlbee.org/main.php/changelog.html

This issue fixed in 1.2.2 was assigned CVE id CVE-2008-3920:

  Unspecified vulnerability in BitlBee before 1.2.2 allows remote
  attackers to "recreate" and "hijack" existing accounts via unspecified
  vectors.

However, upstream released 1.2.3 in the meantime, fixing the incomplete
fix in 1.2.2.  Quoting news page:

  Unfortunately 1.2.2 did not fix all possible account hijacking
  loopholes. Another very similar flaw was found by Tero Marttila. In
  the migration to the user configuration storage abstraction layer, a
  few safeguards that prevent overwriting existing accounts disappeared.
  Over the week I went over all the related code to make sure that
  everything's done in a sane, safe and consistent way.

  http://www.bitlbee.org/main.php/news.r.html

And changelog:

  Version 1.2.3 (released 2008-09-07) hilights:
    * Fixed a security issue similar to the previous account overwrite/hijack bug.

  http://www.bitlbee.org/main.php/changelog.html

This should probably get a new id.

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.