bzrtp: CVE-2016-6271: missing HVI check on DHPart2 packet reception

Debian Bug report logs - #859277
bzrtp: CVE-2016-6271: missing HVI check on DHPart2 packet reception

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: submit@bugs.debian.org

Subject: bzrtp: CVE-2016-6271: missing HVI check on DHPart2 packet reception

Date: Sat, 1 Apr 2017 19:26:04 +0200

Source: bzrtp
Version: 1.0.2-1.1
X-Debbugs-CC: team@security.debian.org secure-testing-team@lists.alioth.debian.org
Severity: important
Tags: security

Hi,

the following vulnerability was published for bzrtp.

CVE-2016-6271[0]:
| The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows
| man-in-the-middle attackers to conduct spoofing attacks by leveraging
| a missing HVI check on DHPart2 packet reception.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-6271
[1] https://github.com/BelledonneCommunications/bzrtp/commit/bbb1e6e2f467ee4bd7b9a8c800e4f07343d7d99b

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 859277-close@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: 859277-close@bugs.debian.org

Subject: Bug#859277: fixed in bzrtp 1.0.2-1.2

Date: Sun, 04 Jun 2017 17:33:39 +0000

Source: bzrtp
Source-Version: 1.0.2-1.2

We believe that the bug you reported is fixed in the latest version of
bzrtp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 859277@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Moritz Muehlenhoff <jmm@debian.org> (supplier of updated bzrtp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 04 Jun 2017 18:24:14 +0200
Source: bzrtp
Binary: libbzrtp0 libbzrtp-dev libbzrtp0-dbg
Architecture: source amd64
Version: 1.0.2-1.2
Distribution: unstable
Urgency: medium
Maintainer: Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org>
Changed-By: Moritz Muehlenhoff <jmm@debian.org>
Description:
 libbzrtp-dev - Development files for the Bzrtp key exchange library
 libbzrtp0  - Library for the ZRTP key exchange protocol
 libbzrtp0-dbg - Debug symbols for the Bzrtp key exchange library
Closes: 859277
Changes:
 bzrtp (1.0.2-1.2) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2016-6271 (Closes: #859277)
Checksums-Sha1:
 cd5270c1c860220a21b91d69391923d5e732b51a 2156 bzrtp_1.0.2-1.2.dsc
 7e1473a31cb6722e5f46d4595a4929e052a32360 11000 bzrtp_1.0.2-1.2.debian.tar.xz
 6056e09d6a6cf0675e85f1457bc17872fca03113 6158 bzrtp_1.0.2-1.2_amd64.buildinfo
 47cfc6b0c7ded0f4f97797ce26d8b125a3de62bf 93718 libbzrtp-dev_1.0.2-1.2_amd64.deb
 ab1fbf5da1a217f957948d2fec267c4461dea17e 62642 libbzrtp0-dbg_1.0.2-1.2_amd64.deb
 c22f37cb50cf9b7e283036190d637a2560905227 32800 libbzrtp0_1.0.2-1.2_amd64.deb
Checksums-Sha256:
 83193d11298090a0a9f15caf9e6bc307efa309e3b715e6530a9fc06194cd1296 2156 bzrtp_1.0.2-1.2.dsc
 b839cc6b4ececc366827b6a4ad47b28a5157bc781963642662b64c40807e27d3 11000 bzrtp_1.0.2-1.2.debian.tar.xz
 db1f958dad365230dcd0ee6173d39be31f44361a8a31295dee1a9b23d6b8bed4 6158 bzrtp_1.0.2-1.2_amd64.buildinfo
 ca97cc13addbdcd6f171278bc97fa43b55083339105a9c6b51128837453bd240 93718 libbzrtp-dev_1.0.2-1.2_amd64.deb
 6bec6c80190ad0db0da4176a9f33a5ee12b93088e64124cd9c0213327e041fe2 62642 libbzrtp0-dbg_1.0.2-1.2_amd64.deb
 0c9b1b1fd9c467a19f70bafe56ea649c225986a6a5113004a56f024796e78f66 32800 libbzrtp0_1.0.2-1.2_amd64.deb
Files:
 de5f4fd4293f0516d6babac85165f211 2156 libs optional bzrtp_1.0.2-1.2.dsc
 cfb93a63f34dadc070a4ad9b7b01a8ae 11000 libs optional bzrtp_1.0.2-1.2.debian.tar.xz
 c452cfcc8725688dd4690607719b3fcb 6158 libs optional bzrtp_1.0.2-1.2_amd64.buildinfo
 f101244fd6876c0f90505a9377f0b4e8 93718 libdevel optional libbzrtp-dev_1.0.2-1.2_amd64.deb
 e05ceb58618e39d26d2ecb1aec976034 62642 debug extra libbzrtp0-dbg_1.0.2-1.2_amd64.deb
 3d0c9e0b98eba042a9f2a268db432734 32800 libs optional libbzrtp0_1.0.2-1.2_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlk0NQgACgkQEMKTtsN8
TjZB6Q//X4mDZ/kIWJp48gWWMvE8gJTjkfxbiJHUPvav+on5uzTty19AKwKC5AuS
fgG/kJG3pMy7+SSuA/fxYVsbe8js8abjEKz09rjuaq75MHifU8GnlWnuEFQCAkPQ
PujyC0gM5uZTMhIYuioIkqBSSBF4MCHF3eJ9zf7tlkaICLJ+HV1ygNJrWih8vQg4
l4fKTNHQlPPq4fLQqQbTiT8sJf68MwIajXi3X3k8zdk0MAZQwu/H+n7y9T+bVa4M
sGBS/TCNS907KWOFJAXG6xMMqtgvwH2B6tT7FSEKM8CDTfcnes2zFUu8OzOiAZq8
Vm5unnzYinQsiLCauha0Ewi6SH9suPLwCZrTJxqO1Hm5HIQ0ZY+dAasW7XnOIA2Q
6JFvOFch71Seg65u6DNbnYTyLe/a2wv5PUnLRiFgqnq0dGo79PmbkZBnIANhbDJD
U3I44uFuFfAHJaE9EAr+BDSy/bJ/8s9kN1zQBV5wZaUbwhI8g21qXkaSgAXbxWWJ
Gu333IRPwO2GEQc3vb3fTSgEX6zUF4k2sO/EGlbuOCKt47QvKVphSyJe+PubVuDe
6PhnbQlak8T+L1TGfWCc5tc3dtAZGJzyLsVTXJzsD97Ka1oIgsGlGDVb/RQfb0dB
Gw6lzVaU4z3OnlUUIkFJs673+y02E3Eg8fEcw+ldlA8We15/eGQ=
=YvRC
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.