oss-security - Re: CVE request for bitlbee

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080908093608.2e28237d@redhat.com>
Date: Mon, 8 Sep 2008 09:36:08 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: vmiklos@...galware.org, coley@...re.org
Subject: Re: CVE request for bitlbee

On Sat, 30 Aug 2008 01:24:14 +0200 Miklos Vajna
<vmiklos@...galware.org> wrote:

> bitlbee-1.2.2 is released, and it comes with a NULL pointer
> dereference fix, which allows people to hijack accounts.
> 
> More info:
> 
> http://bitlbee.org/main.php/changelog.html

This issue fixed in 1.2.2 was assigned CVE id CVE-2008-3920:

  Unspecified vulnerability in BitlBee before 1.2.2 allows remote
  attackers to "recreate" and "hijack" existing accounts via unspecified
  vectors.

However, upstream released 1.2.3 in the meantime, fixing the incomplete
fix in 1.2.2.  Quoting news page:

  Unfortunately 1.2.2 did not fix all possible account hijacking
  loopholes. Another very similar flaw was found by Tero Marttila. In
  the migration to the user configuration storage abstraction layer, a
  few safeguards that prevent overwriting existing accounts disappeared.
  Over the week I went over all the related code to make sure that
  everything's done in a sane, safe and consistent way.

  http://www.bitlbee.org/main.php/news.r.html

And changelog:

  Version 1.2.3 (released 2008-09-07) hilights:
    * Fixed a security issue similar to the previous account overwrite/hijack bug.

  http://www.bitlbee.org/main.php/changelog.html

This should probably get a new id.

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.