Bugzilla Bug 99754

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
  
KDE Security Advisory: libgadu vulnerabilities  
Original Release Date: 2005-07-21  
URL: http://www.kde.org/info/security/advisory-20050721-1.txt  
  
0. References  
        CVE CAN-2005-1852  
  
  
1. Systems affected:  
  
        All versions of Kopete as included in KDE 3.2.3 up to including  
        KDE 3.4.1. KDE 3.2.2 and older are not affected.  
  
        Kopete 0.9.x releases starting with 0.9.4 and Kopete 0.10.3  
        or newer are unaffected.  
  
  
2. Overview:  
  
	Kopete contains a copy of libgadu that is used if  
        no compatible version is installed in the system. Several  
        input validation errors have been reported in libgadu  
        that can lead to integer overflows and remote DoS or  
        arbitrary code execution.  
  
  
3. Impact:  
  
	If the Gadu-Gadu protocol handler in Kopete is used,  
        remote users can DoS the Kopete client or possibly even  
        execute arbitrary code.  
  
  
4. Solution:  
  
        Source code patches have been made available that update  
        the included copy of libgadu to 1.6rc3 which fix these  
        vulnerabilities. Contact your OS vendor / binary package provider  
        for information about how to obtain updated binary packages.  
  
  
5. Patch:  
  
        A patch for KDE 3.4.1 is available from  
        ftp://ftp.kde.org/pub/kde/security_patches :  
  
        675008c8bc9d7edf4d0034a398d15cf0  post-3.4.1-kdenetwork-libgadu.patch  
  
        A patch for KDE 3.3.2 is available from  
        ftp://ftp.kde.org/pub/kde/security_patches :  
  
        73ebcef42173bf567d473414693898b0  post-3.3.2-kdenetwork-libgadu.patch  
  
        A patch for KDE 3.2.3 is available from  
        ftp://ftp.kde.org/pub/kde/security_patches :  
  
        69e3379085aeaeecf034468d18a900f6  post-3.2.3-kdenetwork-libgadu.patch  
  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.0 (GNU/Linux)  
  
iD8DBQFC3w5pvsXr+iuy1UoRAuAyAKC5MQPmvhpYiOtypx50dk7fkLCxWACgg0Lv  
XiS2yq32alcX2bEhEArot+Y=  
=FoUx  
-----END PGP SIGNATURE-----

KDE please provide an updated ebuild. 

Created an attachment (id=63954) [edit]
kdenetwork-3.3.2-r2.ebuild

I don't have time. If someone would test the ebuilds, please?!	What bothers me
is that the dependency is not listed as an optional one, since the shared
libgadu can be used, too. Also Portage doesn't seem to treat SRC_URI
culmulative as it seems.

Created an attachment (id=63955) [edit]
kdenetwork-3.4.1-r1.ebuild

Created an attachment (id=63956) [edit]
kopete-3.4.1-r1.ebuild

arch herds: The patches apply and I don't see why there should be a problem,
testers are welcome.

Thx Carlo. 

So based on what I'm seeing in this bug, I'm assuming that only the 3.3.x and
3.4.x series of kdenetwork/kopete are being patched by us and that 3.2.x is no
longer supported?

Afair GLSA 200412-17 was the first one to not include a fix for 3.2.x. I'm sure 
there are several others after that. 

I tested the ebuilds and committed: 
 
kdenetwork-3.4.1-r1.ebuild 
kdenetwork-3.3.2-r2.ebuild 
kopete-3.4.1-r1.ebuild 
 

Stable on hppa

stable on ppc64

Is it OK to mark these bad boys as blocker during release time when we're under
crunch time if it is holding us up?

Heh...

Well... this is blocking the release at the moment... thanks all

Upgrading severity to blocker as requested by wolf31o2.

(In reply to comment #7)
> So based on what I'm seeing in this bug, I'm assuming that only the 3.3.x and
> 3.4.x series of kdenetwork/kopete are being patched by us and that 3.2.x is no
> longer supported?

Supporting two stable releases should suffice. While adding the fixes for KDE
3.2 as well, wouldn't be a big issue in this case, but the KDE team is small,
some arch teams are, too and not everyone is as sparctastic fast & resposive as
you. ;)

(In reply to comment #8)
> Afair GLSA 200412-17
> 	 was the first one to not include a fix for 3.2.x. I'm sure 
> there are several others after that. 

No. KDE 3.2 wasn't affected in this case. Bug 98735 and this one are the first two.


In case anyone raised an eyebrowe: No portage bug, a kde eclass speciality as I
found out.

Marked ppc stable.

kdenetwork-3.3.2-r2 stable on mips, 3.4 hasn't gone stable on mips yet.

stable on amd64.

Stable on alpha.

Stable on ia64.

sparc stable.

x86 already stable. This one is ready for GLSA. 

Still needing alpha keyword, back to stable. 

Alpha doesn't have any stable 3.4.x version and I already stabled
kdenetwork-3.3.2-r2. I don't think we're missing any keywords but feel free to
correct me if I'm wrong :)

Kloeri sorry for the noise. This one is ready for GLSA. 

Rerating as B (Gadu-gadu is hardly default configuration). 
 
GLSA 200507-23