Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 12 Apr 2010 15:41:34 -0400 (EDT)
From: Josh Bressers <>
Cc: coley <>
Subject: Re: CVE request: irssi 0.8.15

----- "Tobias Heinlein" <> wrote:

> Not sure if everyone has seen this yet:
> "This release fixes two security issues: The first being that Irssi
> didn't check hostname on SSL connections and the other being a hard
> to
> exploit remote crash bug."
> Some further information can be found in the ChangeLog:

This is a bit more than what it appears.

The SSL commit is here:

>From reading the code it really fixes two things.

It fixes the old "does not properly handle a '\0' character in a domain
name in the subject's Common Name (CN) field" flaw, plus also verifies that
the server being connected to is the one listed in the certificate.

Let's assign these as such:
CVE-2010-1154 irssi 0.8.15 /0 in CN field
CVE-2010-1155 irssi 0.8.15 certificate host validation

The crash bits mentioned in the changelog are very ambiguous. The git tree
isn't any more clear than that. There appear to be two crashes, both sound
like NULL pointer dereferences that cannot be triggered by an attacker. If
I'm wrong, please speak up.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.