Bugzilla Bug 159658

There is a possible buffer overflow with the handling of private messages in
ksirc.

dropped kloeri@gentoo.org an email

kde please advise.

this is CVE-2006-6811

I've got a tentative patch from kde-packager but it's yet to audit; word from
Dirk Mueller, though, say tha tthe problem is less serious than it was told, as
he can't find a way to exploit the code being just a NULL pointer reference.

Probably for the last time for me, but ksirc-3.5.5-r1 and kdenetwork-3.5.5-r2
are now in tree.

KDE Security Advisory: ksirc denial of service vulnerability
Original Release Date: 2007-01-09
URL: http://www.kde.org/info/security/advisory-20070109-1.txt

0. References

        CVE-2006-6811
        http://www.milw0rm.com/exploits/3023
        http://www.securityfocus.com/bid/21790


1. Systems affected:

        ksirc as shipped with KDE 3.5.5 or older. KDE 3.5.6 and
        newer is not affected.


2. Overview:

        On 2006-12-27, a proof of concept for arbitrary code execution
        in ksirc was published by Federico L. Bossi Bonin. The
published
        exploit triggers an assertion in ksirc and results in a
        a NULL pointer dereference (crash) for non-debug builds.


3. Impact:

        A malicious IRC server can crash the ksirc client. No arbitrary
        code execution is possible by this vulnerability.


4. Solution:

        Source code patches have been made available which fix these
        vulnerabilities. Contact your OS vendor / binary package provider
        for information about how to obtain updated binary packages.


5. Patch:

        A patch for KDE 3.5.5 is available from
        ftp://ftp.kde.org/pub/kde/security_patches :

        72897a581daa9f71bdf61238f4c3e693
 post-3.5.5-kdenetwork-ksirc.diff

(In reply to comment #5)
> Probably for the last time for me,


i really hope no


> but ksirc-3.5.5-r1 and kdenetwork-3.5.5-r2
> are now in tree.

thanks a lot Diego.

Arches, please test and mark stable these 2 ebuilds, thanks

kde-base/ksirc-3.5.5-r1  USE="kdeenablefinal ssl -arts -debug
-kdehiddenvisibility -xinerama"
1. emerges on x86
2. passes collision test
3. works

Gentoo Base System version 1.12.6
Portage 2.1.1-r2 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.4-r4,
2.6.19.2 i686)
=================================================================
System uname: 2.6.19.2 i686 Genuine Intel(R) CPU           T2300  @ 1.66GHz
Last Sync: Sun, 14 Jan 2007 19:00:01 +0000
ccache version 2.4 [disabled]
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.3.7, 2.0.30
dev-lang/python:     2.3.5-r3, 2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.4-r6
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.14
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf
/etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c"
CXXFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--nospinner"
FEATURES="autoconfig collision-protect distlocks metadata-transfer
parallel-fetch sandbox sfperms strict test userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://mirror.switch.ch/mirror/gentoo/ http://gentoo.inode.at/"
LINGUAS="en de en_GB de_CH"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/pack
ages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X a52 aac acpi alsa alsa_cards_ali5451 alsa_cards_als4000
alsa_cards_atiixp alsa_cards_atiixp-modem alsa_cards_bt87x alsa_cards_ca0106
alsa_cards_cmipci alsa_cards_emu10k1x alsa_cards_ens1370 alsa
_cards_ens1371 alsa_cards_es1938 alsa_cards_es1968 alsa_cards_fm801
alsa_cards_hda-intel alsa_cards_intel8x0 alsa_cards_intel8x0m
alsa_cards_maestro3 alsa_cards_trident alsa_cards_usb-audio alsa_cards_via8
2xx alsa_cards_via82xx-modem alsa_cards_ymfpci alsa_pcm_plugins_adpcm
alsa_pcm_plugins_alaw alsa_pcm_plugins_asym alsa_pcm_plugins_copy
alsa_pcm_plugins_dmix alsa_pcm_plugins_dshare alsa_pcm_plugins_dsnoop
 alsa_pcm_plugins_empty alsa_pcm_plugins_extplug alsa_pcm_plugins_file
alsa_pcm_plugins_hooks alsa_pcm_plugins_iec958 alsa_pcm_plugins_ioplug
alsa_pcm_plugins_ladspa alsa_pcm_plugins_lfloat alsa_pcm_plugin
s_linear alsa_pcm_plugins_meter alsa_pcm_plugins_mulaw alsa_pcm_plugins_multi
alsa_pcm_plugins_null alsa_pcm_plugins_plug alsa_pcm_plugins_rate
alsa_pcm_plugins_route alsa_pcm_plugins_share alsa_pcm_plugin
s_shm alsa_pcm_plugins_softvol apache2 asf berkdb bitmap-fonts cairo cdr cdrom
cli cracklib crypt cups dbus divx dlloader dri dts dvd dvdr dvdread eds
elibc_glibc emboss encode fam ffmpeg firefox flac fort
ran gdbm gif gnome gpm gstreamer gtk hal iconv input_devices_keyboard
input_devices_mouse ipv6 isdnlog java jpeg kde kdeenablefinal kernel_linux ldap
libg++ linguas_de linguas_de_CH linguas_en linguas_en_G
B mad mikmod mmx mono mp3 mpeg ncurses nls nptl nptlonly ogg opengl oss pam
pcre perl png ppds pppd python qt3 qt4 quicktime readline reflection rtsp ruby
samba sdl session smp spell spl sse sse2 sse3 ssl
svg tcpd test tetex theora threads truetype truetype-fonts type1-fonts udev
unicode userland_GNU vcd video_cards_fbdev video_cards_i810 video_cards_vesa
vorbis win32codecs wxwindows x264 xine xml xorg xpri
nt xv xvid zlib"
Unset:  CTARGET, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS,
PORTDIR_OVERLAY

ppc64 stable

x86 stable

sparc stable.

ppc stable

Alpha done.

Thanks arches, that is *very* fast :)

amd64 stable, thanks flameeyes

old GLSA 200701-26

ia64 stable