Related Vulnerabilities: CVE-2013-7449

Source

Debian Bug report logs - #776609
xchat: CVE-2013-7449: XChat does not verify certificate host name

Package: xchat; Maintainer for xchat is Gianfranco Costamagna <locutusofborg@debian.org>; Source for xchat is src:xchat (PTS, buildd, popcon).

Reported by: Marian Sigler <m@qjym.de>

Date: Thu, 29 Jan 2015 22:33:02 UTC

Severity: normal

Tags: security, upstream

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, Davide Puricelli (evo) <evo@debian.org>:
Bug#776609; Package xchat. (Thu, 29 Jan 2015 22:33:06 GMT) (full text, mbox, link).

Acknowledgement sent to Marian Sigler <m@qjym.de>:
New Bug report received and forwarded. Copy sent to Davide Puricelli (evo) <evo@debian.org>. (Thu, 29 Jan 2015 22:33:06 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

Package: xchat
Tags: security


From http://www.openwall.com/lists/oss-security/2015/01/29/23 :

> XChat did not verify that the server hostname matched the domain name in 
> the subject's Common Name (CN) or subjectAltName field in X.509 
> certificates. This could allow a man-in-the-middle attacker to spoof an 
> SSL server if they had a certificate that was valid for any domain name.
> 
> The same code is used in hexchat.
> 
> This was initially reported to hexchat in 2013 [2] and fixed last 
> November [3].
>
> [2] https://github.com/hexchat/hexchat/issues/524
> [3] https://github.com/hexchat/hexchat/commit/c9b63f7f9be01692b03fa15275135a4910a7e02d

Unfortunately I don't have a debian with gui available, but
- there was no upgrade of the package in the last two years
- I didn't find anything its changelog
- I think you would have made some rumors and not just have fixed it
  silently.
So I think it's very probable it is not fixed yet in debian and report
it rather than it being forgotten.


How to verify:

run
  openssl s_server -accept 6667 -cert somevalid.crt -key somevalid.key

Add a server to xchat, select "Use SSL for all servers on this network",
DO NOT select "accept invalid SSL certificate". Add the server name of
the certificate as the server name, to verify it works in principle.
Then configure the server to use another hostname, which is not
contained in the cert, but has the same IP. XChat should refuse to
connect in the second case.



From https://bugzilla.redhat.com/show_bug.cgi?id=1081839 :
> Also, upstream XChat is no longer in active development.

This leads me to suggest to remove XChat from the debian archives, in
particular because with hexchat there is a compatible alternative
available [1] (even they don't desserve too much trust either, having
needed 1.5 years to fix that...)
But I don't know what your rules for things like that are so...

Marian

[1]
http://hexchat.readthedocs.org/en/latest/faq.html#how-do-i-migrate-my-settings-from-xchat

Added tag(s) upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 30 Jan 2015 07:33:04 GMT) (full text, mbox, link).

Reply sent to Debian FTP Masters <ftpmaster@ftp-master.debian.org>:
You have taken responsibility. (Sat, 30 Jan 2016 18:23:00 GMT) (full text, mbox, link).

Notification sent to Marian Sigler <m@qjym.de>:
Bug acknowledged by developer. (Sat, 30 Jan 2016 18:23:00 GMT) (full text, mbox, link).

Message #12 received at 776609-done@bugs.debian.org (full text, mbox, reply):

To: 100767-done@bugs.debian.org,189613-done@bugs.debian.org,203466-done@bugs.debian.org,205825-done@bugs.debian.org,209158-done@bugs.debian.org,225958-done@bugs.debian.org,231199-done@bugs.debian.org,255167-done@bugs.debian.org,255566-done@bugs.debian.org,264765-done@bugs.debian.org,266797-done@bugs.debian.org,267870-done@bugs.debian.org,272751-done@bugs.debian.org,282327-done@bugs.debian.org,288454-done@bugs.debian.org,288511-done@bugs.debian.org,294453-done@bugs.debian.org,306022-done@bugs.debian.org,346228-done@bugs.debian.org,375500-done@bugs.debian.org,379130-done@bugs.debian.org,380205-done@bugs.debian.org,400853-done@bugs.debian.org,400890-done@bugs.debian.org,405099-done@bugs.debian.org,407926-done@bugs.debian.org,416839-done@bugs.debian.org,423288-done@bugs.debian.org,423291-done@bugs.debian.org,429534-done@bugs.debian.org,444333-done@bugs.debian.org,455915-done@bugs.debian.org,462372-done@bugs.debian.org,465547-done@bugs.debian.org,481646-done@bugs.debian.org,487757-done@bugs.debian.org,487950-done@bugs.debian.org,495742-done@bugs.debian.org,499732-done@bugs.debian.org,499733-done@bugs.debian.org,505205-done@bugs.debian.org,505662-done@bugs.debian.org,510239-done@bugs.debian.org,512485-done@bugs.debian.org,517896-done@bugs.debian.org,537662-done@bugs.debian.org,586492-done@bugs.debian.org,590019-done@bugs.debian.org,596381-done@bugs.debian.org,598125-done@bugs.debian.org,599724-done@bugs.debian.org,600399-done@bugs.debian.org,624240-done@bugs.debian.org,626560-done@bugs.debian.org,627135-done@bugs.debian.org,638744-done@bugs.debian.org,640142-done@bugs.debian.org,642286-done@bugs.debian.org,644547-done@bugs.debian.org,646614-done@bugs.debian.org,652381-done@bugs.debian.org,652639-done@bugs.debian.org,665734-done@bugs.debian.org,670686-done@bugs.debian.org,675428-done@bugs.debian.org,675439-done@bugs.debian.org,675823-done@bugs.debian.org,682141-done@bugs.debian.org,683626-done@bugs.debian.org,691477-done@bugs.debian.org,691962-done@bugs.debian.org,696239-done@bugs.debian.org,714127-done@bugs.debian.org,725517-done@bugs.debian.org,726034-done@bugs.debian.org,727004-done@bugs.debian.org,729988-done@bugs.debian.org,732163-done@bugs.debian.org,776609-done@bugs.debian.org,781964-done@bugs.debian.org,794603-done@bugs.debian.org,800383-done@bugs.debian.org,809103-done@bugs.debian.org,809842-done@bugs.debian.org,811008-done@bugs.debian.org,

Version: 2.8.8-7.3+rm

Dear submitter,

as the package xchat has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/811007

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 28 Feb 2016 07:27:32 GMT) (full text, mbox, link).

Bug unarchived. Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Sat, 12 Mar 2016 17:18:03 GMT) (full text, mbox, link).

Bug 776609 cloned as bug 818009 Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Sat, 12 Mar 2016 17:18:04 GMT) (full text, mbox, link).

Bug archived. Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Sat, 12 Mar 2016 17:18:05 GMT) (full text, mbox, link).

Bug unarchived. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 07 Apr 2016 06:03:07 GMT) (full text, mbox, link).

Changed Bug title to 'xchat: CVE-2013-7449: XChat does not verify certificate host name' from 'XChat does not verify certificate host name'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 07 Apr 2016 06:03:07 GMT) (full text, mbox, link).

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Thu, 05 May 2016 07:26:38 GMT) (full text, mbox, link).

Bug unarchived. Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Wed, 09 Aug 2017 22:03:12 GMT) (full text, mbox, link).

Bug reopened Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Wed, 09 Aug 2017 22:03:12 GMT) (full text, mbox, link).

No longer marked as fixed in versions 2.8.8-7.3+rm. Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Wed, 09 Aug 2017 22:03:13 GMT) (full text, mbox, link).

Marked as fixed in versions xchat/2.8.8-10. Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Wed, 09 Aug 2017 22:03:13 GMT) (full text, mbox, link).

Marked Bug as done Request was from Mattia Rizzolo <mattia@debian.org> to control@bugs.debian.org. (Wed, 09 Aug 2017 22:03:14 GMT) (full text, mbox, link).

Notification sent to Marian Sigler <m@qjym.de>:
Bug acknowledged by developer. (Wed, 09 Aug 2017 22:03:15 GMT) (full text, mbox, link).

Bug reopened Request was from Stephen Kitt <skitt@debian.org> to control@bugs.debian.org. (Thu, 17 Aug 2017 16:58:09 GMT) (full text, mbox, link).

No longer marked as fixed in versions xchat/2.8.8-10. Request was from Stephen Kitt <skitt@debian.org> to control@bugs.debian.org. (Thu, 17 Aug 2017 16:58:10 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 14:54:27 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

xchat: CVE-2013-7449: XChat does not verify certificate host name

Debian Bug report logs - #776609
xchat: CVE-2013-7449: XChat does not verify certificate host name

Vulmon Search

About

Products

Connect

xchat: CVE-2013-7449: XChat does not verify certificate host name

Debian Bug report logs - #776609 xchat: CVE-2013-7449: XChat does not verify certificate host name

Vulmon Search

About

Products

Connect

Debian Bug report logs - #776609
xchat: CVE-2013-7449: XChat does not verify certificate host name