Date: Tue, 9 Sep 2008 10:39:37 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com cc: vmiklos@...galware.org, coley@...re.org Subject: Re: CVE request for bitlbee On Mon, 8 Sep 2008, Tomas Hoger wrote: > On Sat, 30 Aug 2008 01:24:14 +0200 Miklos Vajna > This issue fixed in 1.2.2 was assigned CVE id CVE-2008-3920: > > Unspecified vulnerability in BitlBee before 1.2.2 allows remote > attackers to "recreate" and "hijack" existing accounts via unspecified > vectors. > > However, upstream released 1.2.3 in the meantime, fixing the incomplete > fix in 1.2.2. Quoting news page: > > Unfortunately 1.2.2 did not fix all possible account hijacking > loopholes. Another very similar flaw was found by Tero Marttila. In > the migration to the user configuration storage abstraction layer, a > few safeguards that prevent overwriting existing accounts disappeared. Use CVE-2008-3969 for this meta-fix. - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ