Debian Bug report logs - #686454
CVE-2011-5129: xchat buffer overflow

version graph

Package: xchat; Maintainer for xchat is Davide Puricelli (evo) <evo@debian.org>; Source for xchat is src:xchat.

Reported by: Raphael Geissert <geissert@debian.org>

Date: Sat, 1 Sep 2012 18:48:01 UTC

Severity: grave

Tags: confirmed, security

Found in version 2.8.8

Done: Moritz Muehlenhoff <jmm@inutil.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Davide Puricelli (evo) <evo@debian.org>:
Bug#686454; Package xchat. (Sat, 01 Sep 2012 18:48:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to Raphael Geissert <geissert@debian.org>:
New Bug report received and forwarded. Copy sent to Davide Puricelli (evo) <evo@debian.org>. (Sat, 01 Sep 2012 18:48:04 GMT) Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Raphael Geissert <geissert@debian.org>
To: submit@bugs.debian.org
Subject: CVE-2011-5129: xchat buffer overflow
Date: Sat, 1 Sep 2012 13:45:09 -0500
Package: xchat
Severity: grave
Tags: security

Hi,
the following vulnerability was published for xchat.

CVE-2011-5129[0]:
| Heap-based buffer overflow in XChat 2.8.9 and earlier allows remote
| attackers to cause a denial of service (crash) and possibly execute
| arbitrary code via a long response string.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5129
    http://security-tracker.debian.org/tracker/CVE-2011-5129
Please adjust the affected versions in the BTS as needed.

-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net



Marked as found in versions 2.8.8. Request was from Federico Ceratto <federico.ceratto@gmail.com> to control@bugs.debian.org. (Sat, 08 Sep 2012 12:15:05 GMT) Full text and rfc822 format available.

Added tag(s) confirmed. Request was from Federico Ceratto <federico.ceratto@gmail.com> to control@bugs.debian.org. (Sat, 08 Sep 2012 12:15:06 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Davide Puricelli (evo) <evo@debian.org>:
Bug#686454; Package xchat. (Sun, 09 Sep 2012 10:00:03 GMT) Full text and rfc822 format available.

Acknowledgement sent to François Gannaz <francois.gannaz@free.fr>:
Extra info received and forwarded to list. Copy sent to Davide Puricelli (evo) <evo@debian.org>. (Sun, 09 Sep 2012 10:00:03 GMT) Full text and rfc822 format available.

Message #14 received at 686454@bugs.debian.org (full text, mbox):

From: François Gannaz <francois.gannaz@free.fr>
To: 686454@bugs.debian.org
Subject: Re: CVE-2011-5129: xchat buffer overflow
Date: Sun, 9 Sep 2012 11:57:39 +0200
Hi,

I can't reproduce this bug on my amd64 testing debian, using XFCE and
xchat 2.8.8-6.

With the "proof of concept" script referenced in the CVE, I get no crash.
Only the following line on STDERR repeated thousands of times:
*** XCHAT WARNING: Buffer overflow - shit server!

The part of the code that handles this security concern is:
http://xchat.svn.sourceforge.net/viewvc/xchat/src/common/server.c?revision=1502&view=markup#l410
It first fills a buffer with recv() from sys/socket, then reads it char
by char untill the destination is full (line 472).

Hope that helps



Reply sent to Moritz Muehlenhoff <jmm@inutil.org>:
You have taken responsibility. (Wed, 19 Sep 2012 15:54:05 GMT) Full text and rfc822 format available.

Notification sent to Raphael Geissert <geissert@debian.org>:
Bug acknowledged by developer. (Wed, 19 Sep 2012 15:54:05 GMT) Full text and rfc822 format available.

Message #19 received at 686454-done@bugs.debian.org (full text, mbox):

From: Moritz Muehlenhoff <jmm@inutil.org>
To: François Gannaz <francois.gannaz@free.fr>
Cc: 686454-done@bugs.debian.org
Subject: Re: CVE-2011-5129: xchat buffer overflow
Date: Wed, 19 Sep 2012 17:31:04 +0200
On Sun, Sep 09, 2012 at 11:57:39AM +0200, François Gannaz wrote:
> Hi,
> 
> I can't reproduce this bug on my amd64 testing debian, using XFCE and
> xchat 2.8.8-6.
> 
> With the "proof of concept" script referenced in the CVE, I get no crash.
> Only the following line on STDERR repeated thousands of times:
> *** XCHAT WARNING: Buffer overflow - shit server!
> 
> The part of the code that handles this security concern is:
> http://xchat.svn.sourceforge.net/viewvc/xchat/src/common/server.c?revision=1502&view=markup#l410
> It first fills a buffer with recv() from sys/socket, then reads it char
> by char untill the destination is full (line 472).

This is confirmed by the analysis in Red Hat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=853321#c4

Closing.

Cheers,
        Moritz 



Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Thu, 18 Oct 2012 07:26:22 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Apr 20 06:56:16 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.