CVE-2011-5129: xchat buffer overflow

Debian Bug report logs - #686454
CVE-2011-5129: xchat buffer overflow

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <geissert@debian.org>

To: submit@bugs.debian.org

Subject: CVE-2011-5129: xchat buffer overflow

Date: Sat, 1 Sep 2012 13:45:09 -0500

Package: xchat
Severity: grave
Tags: security

Hi,
the following vulnerability was published for xchat.

CVE-2011-5129[0]:
| Heap-based buffer overflow in XChat 2.8.9 and earlier allows remote
| attackers to cause a denial of service (crash) and possibly execute
| arbitrary code via a long response string.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5129
    http://security-tracker.debian.org/tracker/CVE-2011-5129
Please adjust the affected versions in the BTS as needed.

-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

Message #14 received at 686454@bugs.debian.org (full text, mbox, reply):

From: François Gannaz <francois.gannaz@free.fr>

To: 686454@bugs.debian.org

Subject: Re: CVE-2011-5129: xchat buffer overflow

Date: Sun, 9 Sep 2012 11:57:39 +0200

Hi,

I can't reproduce this bug on my amd64 testing debian, using XFCE and
xchat 2.8.8-6.

With the "proof of concept" script referenced in the CVE, I get no crash.
Only the following line on STDERR repeated thousands of times:
*** XCHAT WARNING: Buffer overflow - shit server!

The part of the code that handles this security concern is:
http://xchat.svn.sourceforge.net/viewvc/xchat/src/common/server.c?revision=1502&view=markup#l410
It first fills a buffer with recv() from sys/socket, then reads it char
by char untill the destination is full (line 472).

Hope that helps

Message #19 received at 686454-done@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: François Gannaz <francois.gannaz@free.fr>

Cc: 686454-done@bugs.debian.org

Subject: Re: CVE-2011-5129: xchat buffer overflow

Date: Wed, 19 Sep 2012 17:31:04 +0200

On Sun, Sep 09, 2012 at 11:57:39AM +0200, François Gannaz wrote:
> Hi,
> 
> I can't reproduce this bug on my amd64 testing debian, using XFCE and
> xchat 2.8.8-6.
> 
> With the "proof of concept" script referenced in the CVE, I get no crash.
> Only the following line on STDERR repeated thousands of times:
> *** XCHAT WARNING: Buffer overflow - shit server!
> 
> The part of the code that handles this security concern is:
> http://xchat.svn.sourceforge.net/viewvc/xchat/src/common/server.c?revision=1502&view=markup#l410
> It first fills a buffer with recv() from sys/socket, then reads it char
> by char untill the destination is full (line 472).

This is confirmed by the analysis in Red Hat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=853321#c4

Closing.

Cheers,
        Moritz 

Send a report that this bug log contains spam.