Date: Tue, 13 Apr 2010 22:47:08 +0200 From: Wouter Coekaerts <coekie@...si.org> To: oss-security@...ts.openwall.com Subject: Re: CVE request: irssi 0.8.15 Hi, > I believe assignment of CVE-2010-1154 is redundant here, given that > CVE-2010-1155 is about the completely missing server name check. If it > wasn't checking names, it wasn't handling \0 in names incorrectly. Indeed. It never checked the hostname at all, so there was no mishandling of \0. > The crash bits mentioned in the changelog are very ambiguous. The git tree > isn't any more clear than that. There appear to be two crashes, both sound > like NULL pointer dereferences that cannot be triggered by an attacker. If > I'm wrong, please speak up. It is about this entry in the changelog/NEWS: - Fix crash when checking for fuzzy nick match when not on the channel. Reported by Aurelien Delaitre (SATE 2009). The fix is revision 5126 ( http://svn.irssi.org/cgi-bin/viewvc.cgi/irssi/trunk/src/core/nicklist.c?root=irssi&r1=4922&r2=5126 ) It is only exploitable (resulting in a crash) at the exact moment the victim is leaving a channel. With some good timing it can be triggered by an attacker. Regards, Wouter aka coekie Irssi developer.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.