close Warning: Failed to sync with repository "(default)": [Errno 12] Cannot allocate memory; repository information may be out of date. Look in the Trac log for more information including mitigation strategies.

Custom Query (1098 matches)

Filters
 
Or
 
  
 
Columns

Show under each result:


Results (16 - 18 of 1098)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Ticket Resolution Summary Owner Reporter
#1281 fixed bitlbee-libpurple: Use after free when expiring file transfer requests dx
Description

Description

Pending file transfer requests expire after 120 seconds, which may result in use after free if the corresponding account is disconnected. A malicious remote server could force this disconnection.

CVE-2016-10188 has been assigned for this issue.

Impact

This results in denial of service (remote crash of the BitlBee instance), or remote code execution (theoretically).

For BitlBee servers configured in ForkDaemon mode (default) or inetd mode, the crash is limited to one user connection, who may just reconnect.

  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Partial
  • Exploitability: Functional Exploit Exists
  • Remediation Level: Official Fix
  • Report Confidence: Confirmed
  • Target Distribution: Medium
  • CVSS v2 score: 1.6

Affected versions

bitlbee-libpurple 3.4.2 or older

Unaffected versions

bitlbee (non-libpurple builds), any version

bitlbee-libpurple 3.5

Resolution

  • Upgrade to 3.5 (released 2017-01-08)
  • For 3.4.2 see the attached

0001-purple-fix-file-transfer-memory-management-3.4.2.patch

  • For 3.4.1 and 3.4 see the attached

0001-purple-fix-file-transfer-memory-management-3.4-3.4.1.patch

  • For earlier versions upgrading is strongly recommended because of

the amount of accumulated bugfixes, but the following line may be removed from protocols/purple/purple.c to prevent any processing of incoming file transfers:

purple_xfers_set_ui_ops(&bee_xfer_uiops);

Discussion

This affects any libpurple protocol when used through BitlBee. It does not affect other libpurple-based clients such as pidgin.

This is a very visible issue - all file transfer request attempts and all disconnections will be logged in the control channel and visible by the targeted user. File transfer requests look like this:

<@root> [account] - File transfer request from [username] for
[filename] (0 kb).
<@root> Accept the file transfer if you'd like the file. If you
don't, issue the 'transfer reject' command.

Cancelling the file transfer request using the "transfer reject" command before the disconnection happens can prevent this. However, using that command after the account is disconnected will result in an immediate crash.

References

CVE-2016-10188: Original bugfix commit:

https://github.com/bitlbee/bitlbee/commit/ea902752503fc5b356d6513911081ec932d804f2

#1275 fixed Sometimes double expansion of t.co URLs wilmer wilmer
Description

Sometimes you get a t.co URL expanded multiple times. Looks like this is just because they're mentioned in Twitter JSON repeatedly (man that stuff is verbose).

Funny thing is it seems to happen more in the live feed than in backlog. Happens in decoded DMs all the time IME.

Would be nice to detect this and stick to just one expansion.

#1274 fixed Improve handling of missing protocols dx
Description

This garbage:

<@root> Error loading user config: Protocol not found: `telegram'
<@root> Unknown error while loading configuration

The next libpurple release will remove a handful of dead protocols, would be painful for everyone involved to leave it like this.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Note: See TracQuery for help on using queries.