Date: Fri, 27 Mar 2015 14:16:41 -0400 (EDT) From: cve-assign@...re.org To: pierre@...ctos.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request: denial of service in Quassel -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > The following commit fixed a denial of service in quassel: > https://github.com/quassel/quassel/commit/b5e38970ffd55e2dd9f706ce75af9a8d7730b1b8 > It allows a connected client to cause a core crash by sending a CTCP > request which would be too long and multibyte. We're not sure how many CVE IDs would be best. b5e38970ffd55e2dd9f706ce75af9a8d7730b1b8 seems to describe two items in terms of bugs and two other items in terms of (somewhat unrelated) solutions. In order of likelihood of CVEs, we have: 1 > The second is > the core crash caused by sending an overlength CTCP query ("/me") > containing only multibyte characters. This bug was caused by the > old CTCP splitter using the byte index from lastParamOverrun() as > a character index for a QString. This seems to be, very roughly, an issue of incorrectly determining a data-structure length by using a wrong-sized data type for counting. It happens to be about multibyte characters but that's of secondary importance. This will almost certainly have a unique CVE ID, but we will see if there are any comments stating that it occurs for exactly the same reason as the "garbage characters" issue below. 2 > Unlike what it replaces, the new splitting code is not recursive > and cannot cause stack overflows. If an attacker sends a crafted message and this leads to excessive stack consumption in an IRC client, making the client crash or hang, then that is relevant for a CVE. (We are expecting that it is a "normal" IRC client that supports independent sessions with messages from different channels or different persons.) However, b5e38970ffd55e2dd9f706ce75af9a8d7730b1b8 doesn't actually state that the client would ever crash or hang. 3 > The first is garbage characters caused > by accidentally splitting the string in the middle of a multibyte > character. Since the new code splits at a character level instead > of a byte level, this will no longer be an issue. This one seems to be inherently about multibyte characters because it's an issue of string display (or string interpretation) if whole characters aren't preserved. However, it doesn't seem to be announced as a security issue. Although someone might be sending security-critical messages over IRC and would not want those messages to be misinterpreted, that's generally too much of a leap to have a CVE. If nobody else has other analysis, we will probably treat this as a non-security bug. 4 > if it is unable > to split a string, it will give up gracefully and not crash the > core or cause a thread to run away. As far as we can tell, this is about: // If the QTBF fails to find a split point in Grapheme mode, we give up. // This should never happen, but it should be handled anyway. qWarning() << "Unexpected failure to split message!"; return msgsToSend; in the patched code. If nobody else has other analysis, we will probably treat this as a defense-in-depth measure that doesn't address any known vulnerability, and therefore has no CVE. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVFZ3gAAoJEKllVAevmvmsWEMH/3xM4kfqaLgXrF3iZrUXjegK nMWFIb3BmdWaqDuOjVN5EoTCCEkBKBeyLLwx6WJwW04ZoACVjacoCikDOntTTKkG E4MyVfLmkREDk3M5myoR2mFf/OxLyTo9bAKrd0nrM4/XGc6hBt4W8G5K1nvYhQzv rCiQdvz0lYzz4baMWFztMMzso057NAa2g7GuHAXMaHfhOrBWzuEE3bXN2Opw8XTn muXAvneBi9VhFSJM74+hCzHhBN11M7KhdB+jgOUSftnnsgdX8smUImu7lQMcJGiI FsU1yUOZWpiyJ06HXfWQ3Kg5y16/1YbkwjvBgAUXX18Not8lpKFcYCYNtLymP/g= =2UPe -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.