[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 12 Apr 2010 15:41:34 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: CVE request: irssi 0.8.15
----- "Tobias Heinlein" <keytoaster@...too.org> wrote:
> Not sure if everyone has seen this yet:
>
> http://irssi.org/
>
> "This release fixes two security issues: The first being that Irssi
> didn't check hostname on SSL connections and the other being a hard
> to
> exploit remote crash bug."
>
> Some further information can be found in the ChangeLog:
> http://irssi.org/news/ChangeLog
This is a bit more than what it appears.
The SSL commit is here:
http://github.com/ensc/irssi-proxy/commit/85bbc05b21678e80423815d2ef1dfe26208491ab
>From reading the code it really fixes two things.
It fixes the old "does not properly handle a '\0' character in a domain
name in the subject's Common Name (CN) field" flaw, plus also verifies that
the server being connected to is the one listed in the certificate.
Let's assign these as such:
CVE-2010-1154 irssi 0.8.15 /0 in CN field
CVE-2010-1155 irssi 0.8.15 certificate host validation
The crash bits mentioned in the changelog are very ambiguous. The git tree
isn't any more clear than that. There appear to be two crashes, both sound
like NULL pointer dereferences that cannot be triggered by an attacker. If
I'm wrong, please speak up.
--
JB
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
