Bugzilla Bug 190667

bannedit has reported a vulnerability in BitchX, which can potentially be
exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when handling IRC MODE
messages. This can be exploited to cause a buffer overflow by sending a MODE
message with an overly long parameter to an affected IRC client.

Successful exploitation may allow the execution of arbitrary code, but requires
that the user is tricked into connecting to a malicious server.

The vulnerability is reported in BitchX 1.1. Other versions may also be
affected.

Solution:
Do not connect to untrusted IRC servers.

setting status, and waiting for upstream to provide a fix.

This is CVE-2007-4584.

Hmm, what's the status here? jokey talked of masking it few days ago, but
lu_zero you wanted to keep it since you fixed the last security issue (bug
183149). So what do we do now? 

keep it please.

Created an attachment (id=131832) [details]
fix for the p_mode overflow

Here's a proposed fix. But:
1) could someone confirm that my fix is correct and complete? I don't want to
screw up like last time with eggdrop. bannedit, since you wrote the exploit,
maybe you can?
2) There's good chances that bitchx contains other vulnerabilities, this is old
unmaintained code (generates lots of warnings when compiling it).
In the end, I don't know if it really is a good idea to keep it. lu_zero,
unless you *really* want to keep this, in which case I guess you should become
the maintainer, I think we should just p.mask the thing. 

According to nion from Debian who reviewed this patch, it does not fix all the
issues. His tries at fixing this were unsuccessful, too:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=443544

Lu, please advise.

I'd recommend to mask and possibly last-rite it afterwards, since it does not
look like this issue will be resolved by anyone.

Sorry, I'm back alive, I'd p.mask the package for now. I do not have time to
check  if the fix is ok, bx sadly it's quite good for a number of people and I
couldn't find valid replacements yet.

(In reply to comment #8)
> Sorry, I'm back alive, I'd p.mask the package for now. I do not have time to
> check  if the fix is ok, bx sadly it's quite good for a number of people and I
> couldn't find valid replacements yet.

Nion reviewed the patch and the bx code and did not find an appropriate fix yet
and I did not see anyone but him and us struggling with the package any more.
Please p.mask for now or deal with the unfortunate task of doing the upstream
work here.

Another issue just popped up.


Secunia -- BitchX "e_hostname()" Insecure Temporary File Creation:
A security issue has been reported in BitchX, which can be exploited by
malicious, local users to perform certain actions with escalated privileges.

The security issue is caused due to the "e_hostname()" function creating a
temporary file insecurely using the "tmpnam()" function when the user issues
the "HOSTNAME" or the "IRCHOST" command. This can be exploited to overwrite
arbitrary files on the local system with the privileges of the user running
BitchX.

http://secunia.com/advisories/27463/

net-irc/lu_zero, could you please p.mask this until we have a fix?

(In reply to comment #11)
> net-irc/lu_zero, could you please p.mask this until we have a fix?
> 

*ping*

net-irc/lu_zero please mask it, as I don't think a patch which suddenly
appeared

This long of a delay is actually not acceptable.

Package is masked now, sorry for the delay

Danke Markus.

We need a mask glsa for this one; request filed.

GLSA 200807-12, sorry for the delay