oss-security - Re: CVE request for bitlbee

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 9 Sep 2008 10:39:37 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: vmiklos@...galware.org, coley@...re.org
Subject: Re: CVE request for bitlbee


On Mon, 8 Sep 2008, Tomas Hoger wrote:

> On Sat, 30 Aug 2008 01:24:14 +0200 Miklos Vajna
> This issue fixed in 1.2.2 was assigned CVE id CVE-2008-3920:
>
>   Unspecified vulnerability in BitlBee before 1.2.2 allows remote
>   attackers to "recreate" and "hijack" existing accounts via unspecified
>   vectors.
>
> However, upstream released 1.2.3 in the meantime, fixing the incomplete
> fix in 1.2.2.  Quoting news page:
>
>   Unfortunately 1.2.2 did not fix all possible account hijacking
>   loopholes. Another very similar flaw was found by Tero Marttila. In
>   the migration to the user configuration storage abstraction layer, a
>   few safeguards that prevent overwriting existing accounts disappeared.

Use CVE-2008-3969 for this meta-fix.

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.