oss-sec mailing list archives
Re: CVE request for bitlbee
From: Tomas Hoger <thoger () redhat com>
Date: Mon, 8 Sep 2008 09:36:08 +0200
On Sat, 30 Aug 2008 01:24:14 +0200 Miklos Vajna <vmiklos () frugalware org> wrote:
bitlbee-1.2.2 is released, and it comes with a NULL pointer dereference fix, which allows people to hijack accounts. More info: http://bitlbee.org/main.php/changelog.html
This issue fixed in 1.2.2 was assigned CVE id CVE-2008-3920: Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vectors. However, upstream released 1.2.3 in the meantime, fixing the incomplete fix in 1.2.2. Quoting news page: Unfortunately 1.2.2 did not fix all possible account hijacking loopholes. Another very similar flaw was found by Tero Marttila. In the migration to the user configuration storage abstraction layer, a few safeguards that prevent overwriting existing accounts disappeared. Over the week I went over all the related code to make sure that everything's done in a sane, safe and consistent way. http://www.bitlbee.org/main.php/news.r.html And changelog: Version 1.2.3 (released 2008-09-07) hilights: * Fixed a security issue similar to the previous account overwrite/hijack bug. http://www.bitlbee.org/main.php/changelog.html This should probably get a new id. -- Tomas Hoger / Red Hat Security Response Team
Current thread:
- CVE request for bitlbee Miklos Vajna (Aug 29)
- Re: CVE request for bitlbee Tomas Hoger (Sep 08)
- Re: CVE request for bitlbee Steven M. Christey (Sep 09)
- Re: CVE request for bitlbee Tomas Hoger (Sep 08)