Bug 388051 – <net-im/empathy-2.34.0-r2: HTML/web script injection vulnerabilities (CVE-2011-{3635,4170})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sean Amoss (RETIRED) 2011-10-21 21:44:53 UTC]

From the Secunia Advisory at $URL:

"A vulnerability has been reported in GNOME Empathy, which can be
exploited by malicious users to conduct script insertion attacks.

Input passed via the nickname is not properly sanitised within the
Adium theme before being used. This can be exploited to insert
arbitrary HTML and script code, which will be executed in a user's IM
session in context of the user's chat room when malicious data is
displayed.

The vulnerability is reported in version 3.2.1. Other versions may
also be affected."

The upstream bug also lists that the default theme in 2.x versions are vulnerable:
https://bugzilla.gnome.org/show_bug.cgi?id=662035

[Comment 1 Alexandre Rostovtsev (RETIRED) 2011-10-21 23:27:50 UTC]

Created attachment 290491 [details, diff]
patch for empathy-2.32 and 2.34

Upstream patch has been applied in gnome overlay in empathy-3.2.1-r1; however, I am not sure if the upstream fix is sufficiently complete (see https://bugzilla.gnome.org/show_bug.cgi?id=662035#c13).

All versions of empathy in portage are currently vulnerable.

Empathy-3.0.2 will not be fixed; it is masked, and will be punted within the next week or two and replaced with 3.2.x

Pacho, please test that the attached backported patch works for for empathy-2.32.2 and empathy-2.34.0. It should be correct, but I don't have a gnome-2 machine to test on.

[Comment 2 Pacho Ramos 2011-10-24 18:33:22 UTC]

+*empathy-2.34.0-r2 (24 Oct 2011)
+
+  24 Oct 2011; Pacho Ramos <[e-mail]> +empathy-2.34.0-r2.ebuild,
+  +files/empathy-2.34.0-CVE-2011-3635.patch,
+  +files/empathy-2.34.0-missing-include.patch:
+  Fix script injection vulnerability (CVE-2011-3635), bug #388051 (backported
+  patch by Tetromino); fix compilation error due missing header, bug #388203 by
+  My Th. Readd dropped keywords after masking offending map USE flag for them,
+  that arches shouldn't stick with old 2.32.x versions.
+

[Comment 3 Tim Sammut (RETIRED) 2011-10-24 18:55:00 UTC]

(In reply to comment #2)
> +*empathy-2.34.0-r2 (24 Oct 2011)
> +

Great, thank you.

Arches, please test and mark stable:
=net-im/empathy-2.34.0-r2
Target keywords : "alpha amd64 ppc x86"

[Comment 4 Sean Amoss (RETIRED) 2011-10-24 20:35:26 UTC]

@tetromino: Does =net-im/empathy-2.34.0-r2 also include the fix for CVE-2011-4170 (the /me-type events you noted in the upstream bug - https://bugzilla.gnome.org/show_bug.cgi?id=662035#c13)?

[Comment 5 Agostino Sarubbo 2011-10-24 21:01:45 UTC]

@gnome, a lot of unrecognized configure options like:

configure: WARNING: unrecognized options: --disable-schemas-compile, --disable-call, --disable-location, --disable-control-center-embedding, --disable-debug, --without-eds, --disable-map, --disable-nautilus-sendto, --without-connectivity, --disable-spell, --disable-webkit

are known?

[Comment 6 Alexandre Rostovtsev (RETIRED) 2011-10-24 21:13:47 UTC]

(In reply to comment #4)
> @tetromino: Does =net-im/empathy-2.34.0-r2 also include the fix for
> CVE-2011-4170 (the /me-type events you noted in the upstream bug -
> https://bugzilla.gnome.org/show_bug.cgi?id=662035#c13)?

Yes. Like the patch comment says, "escape alias on /me-type events too".

[Comment 7 Agostino Sarubbo 2011-10-24 21:17:22 UTC]

(In reply to comment #6)
> Yes. Like the patch comment says, "escape alias on /me-type events too".

Well amd64 ok.

[Comment 8 Pacho Ramos 2011-10-24 22:43:44 UTC]

(In reply to comment #5)
> @gnome, a lot of unrecognized configure options like:
> 
> configure: WARNING: unrecognized options: --disable-schemas-compile,
> --disable-call, --disable-location, --disable-control-center-embedding,
> --disable-debug, --without-eds, --disable-map, --disable-nautilus-sendto,
> --without-connectivity, --disable-spell, --disable-webkit
> 
> are known?

Yes, if I don't misremember, they are related to a configure run for telepathy-yell or something similar inside empathy

[Comment 9 Elijah "Armageddon" El Lazkani (amd64 AT) 2011-10-25 05:06:56 UTC]

amd64: pass

[Comment 10 GLSAMaker/CVETool Bot 2011-10-26 03:44:24 UTC]

CVE-2011-4170 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4170):
  Cross-site scripting (XSS) vulnerability in the theme_adium_append_message
  function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in
  Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web
  script or HTML via a crafted alias (aka nickname) in a /me event, a
  different vulnerability than CVE-2011-3635.

CVE-2011-3635 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3635):
  Cross-site scripting (XSS) vulnerability in the theme_adium_append_message
  function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in
  Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web
  script or HTML via a crafted alias (aka nickname).

[Comment 11 Alexandre Rostovtsev (RETIRED) 2011-10-26 08:20:39 UTC]

Note about the scope of the vulnerability:

Only users who have empathy installed with USE=webkit and who have manually downloaded and enabled an Adium theme in ~/.local/share/adium/message-styles/ are vulnerable. The default vanilla settings are not going to be vulnerable.

To disable the selected Adium theme in empathy-2.34 or empathy-3.x, a user could do

gsettings set org.gnome.Empathy.conversation adium-path ''

[Comment 12 Markos Chandras (RETIRED) 2011-10-30 11:48:48 UTC]

amd64 done. Thanks Agostino

[Comment 13 Paweł Hajdan, Jr. (RETIRED) 2011-10-30 12:38:00 UTC]

x86 stable

[Comment 14 Brent Baude (RETIRED) 2011-11-06 13:01:04 UTC]

ppc done

[Comment 15 Pacho Ramos 2011-11-22 01:06:20 UTC]

alpha, I accidentally dropped old telepathy-logger versions and, then, your stable empathy version is no longer installable. Sorry :(

I though on readding old telepathy-logger version but, as your current stable version is affected by this security bug, I thought would be better (and easier) to simply stabilize fixed empathy version. Could you give a higher priority to this? Thanks a lot

[Comment 16 Tobias Klausmann (RETIRED) 2012-01-16 14:10:45 UTC]

Stable on alpha.

[Comment 17 Agostino Sarubbo 2012-01-16 14:11:27 UTC]

@security: please vote

[Comment 18 Tim Sammut (RETIRED) 2012-01-16 16:09:57 UTC]

Thanks, folks. GLSA vote: no.

[Comment 19 Sean Amoss (RETIRED) 2012-01-16 20:46:43 UTC]

NO, too. Both CVE's are actually a form of XSS - closing noglsa. Thanks, everyone.