Re: CVE Request: jabberd remote information disclosure

[Moritz Muehlenhoff <jmm () debian org>]

On Mon, Feb 09, 2015 at 10:55:11PM +0100, Thijs Alkemade wrote:
> Hello,
>
> A buffer overflow was found in the XMPP server jabberd2 when normalizing
> strings that can lead to remote information disclosure [1]. When parsing a
> JID, jabberd2 version 2.3.2 and below truncate the data but do not verify
> whether the result is valid UTF8 before passing it to libidn. If the data ends
> with an unterminated multi-byte UTF8 sequence then libidn may copy data past
> the buffer into the result. This can be exploited by remote clients or remote
> servers.
>
> Could you please assign a CVE for this issue?
>
> [1] = https://github.com/jabberd2/jabberd2/issues/85

This seems to have fallen through the cracks, adding cve-assign to CC.

Cheers,
        Moritz