Date: Mon, 8 Sep 2008 09:36:08 +0200 From: Tomas Hoger <thoger@...hat.com> To: oss-security@...ts.openwall.com Cc: vmiklos@...galware.org, coley@...re.org Subject: Re: CVE request for bitlbee On Sat, 30 Aug 2008 01:24:14 +0200 Miklos Vajna <vmiklos@...galware.org> wrote: > bitlbee-1.2.2 is released, and it comes with a NULL pointer > dereference fix, which allows people to hijack accounts. > > More info: > > http://bitlbee.org/main.php/changelog.html This issue fixed in 1.2.2 was assigned CVE id CVE-2008-3920: Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vectors. However, upstream released 1.2.3 in the meantime, fixing the incomplete fix in 1.2.2. Quoting news page: Unfortunately 1.2.2 did not fix all possible account hijacking loopholes. Another very similar flaw was found by Tero Marttila. In the migration to the user configuration storage abstraction layer, a few safeguards that prevent overwriting existing accounts disappeared. Over the week I went over all the related code to make sure that everything's done in a sane, safe and consistent way. http://www.bitlbee.org/main.php/news.r.html And changelog: Version 1.2.3 (released 2008-09-07) hilights: * Fixed a security issue similar to the previous account overwrite/hijack bug. http://www.bitlbee.org/main.php/changelog.html This should probably get a new id. -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ