Bugzilla Bug 234819

CVE-2008-3680 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3680):
  The decryption function in Flagship Industries Ventrilo 3.0.2 and earlier
  allows remote attackers to cause a denial of service (NULL pointer
  dereference and server crash) by sending a type 0 packet with an invalid
  version followed by another packet to TCP port 3784.

Version 3.0.3 is in the tree, is this still an issue?

Ventrilo Server - Public - Version 2.3.1
(c)Copyright 1999-2005 Flagship Industries, Inc.

Version           = 2.3.1
Name              = Server 1
Phonetic          = Server 1
Auth              = 0
Duplicates        = 1
MaxClients        = 8
SendBuffer        = 131072
RecvBuffer        = 131072
LogonTimeout      = 5
CloseStd          = 1
TimeStamp         = 0
PingRate          = 10
ExtraBuffer       = 131072
ChanWidth         = 0
ChanDepth         = 8
ChanClients       = 0
DisableQuit       = 1
VoiceCodec        = 0 (GSM 6.10)
VoiceFormat       = 1 (11 KHz, 16 bit) - Bytes/Sec 2210
SilentLobby       = 0
AutoKick          = 0

Accepting connections on these interface(s).
  1: 0.0.0.0

Accepting UDP Status/Control messages on these interface(s).
  1: 0.0.0.0

READY:
MSG_CONN: ID 1, IP 127.0.0.1, Accepted. (50820,262142) (87680,262142)
Incompatible version. Server is running version 2.3.1
zsh: segmentation fault  ./ventrilo_srv


$ ./ventrilobotomy localhost

Ventrilo <= 3.0.2 NULL pointer 0.1
by Luigi Auriemma and Andre Malm
e-mail: aluigi@autistici.org
web:    aluigi.org

- target:   127.0.0.1 : 3784
- connect
- send a wrong version packet
- send some data for forcing the decryption function
- wait some seconds
- test server:

  Server IS vulnerable!!!

========================================================================

Ventrilo Server - Public - Version 3.0.2
(c)Copyright 1999-2007 Flagship Industries, Inc.

Version           = 3.0.2
Name              = Server 1
Phonetic          = Server 1
Auth              = 0
Duplicates        = 1
SendBuffer        = 131072
RecvBuffer        = 131072
LogonTimeout      = 5
CloseStd          = 1
TimeStamp         = 0
PingRate          = 10
ExtraBuffer       = 131072
ChanWidth         = 0
ChanDepth         = 8
ChanClients       = 0
DisableQuit       = 0
VoiceCodec        = 0 (GSM 6.10)
VoiceFormat       = 1 (11 KHz, 16 bit) - Bytes/Sec 2210
SilentLobby       = 0
AutoKick          = 0
MaxClients        = 8


READY:
MSG_CONN: ID 1, IP 127.0.0.1, Accepted. (50820,262142) (87680,262142)
Incompatible version. Server is running version 3.0.2
SIGNAL: SEGV.

$ ./ventrilobotomy localhost

Ventrilo <= 3.0.2 NULL pointer 0.1
by Luigi Auriemma and Andre Malm
e-mail: aluigi@autistici.org
web:    aluigi.org

- target:   127.0.0.1 : 3784
- connect
- send a wrong version packet
- send some data for forcing the decryption function
- wait some seconds
- test server:

  Server IS vulnerable!!!

========================================================================

Ventrilo Server - Public - Version 3.0.3
(c)Copyright 1999-2008 Flagship Industries, Inc.

Version           = 3.0.3
Name              = Server 1
Phonetic          = Server 1
Auth              = 0
Duplicates        = 1
SendBuffer        = 131072
RecvBuffer        = 131072
LogonTimeout      = 5
CloseStd          = 1
TimeStamp         = 0
PingRate          = 10
ExtraBuffer       = 131072
ChanWidth         = 0
ChanDepth         = 8
ChanClients       = 0
DisableQuit       = 0
VoiceCodec        = 0 (GSM 6.10)
VoiceFormat       = 1 (11 KHz, 16 bit) - Bytes/Sec 2210
SilentLobby       = 0
AutoKick          = 0
MaxClients        = 8


READY:
MSG_CONN: ID 1, IP 127.0.0.1, Accepted. (50820,262142) (87680,262142)
Incompatible version. Server is running version 3.0.3
MSG_ABORT: ID 1, 127.0.0.1 aborted.
MSG_CONN: ID 2, IP 127.0.0.1, Accepted. (50820,262142) (87680,262142)
MSG_ABORT: ID 2, 127.0.0.1 aborted.


$ ./ventrilobotomy localhost

Ventrilo <= 3.0.2 NULL pointer 0.1
by Luigi Auriemma and Andre Malm
e-mail: aluigi@autistici.org
web:    aluigi.org

- target:   127.0.0.1 : 3784
- connect
- send a wrong version packet
- send some data for forcing the decryption function
- wait some seconds
- test server:

  Server doesn't seem vulnerable

Since 2.3.1 does not install anyway (missing distfile and fetch restrictions),
and 3.0.3 seems to fix the issue, is 3.0.3 ok for stabling?

Arches, please test and mark stable:
=media-sound/ventrilo-server-bin-3.0.3
Target keywords : "amd64 x86"

amd64/x86 stable, all arches done.

It's an easy DoS on a server application, so YES.

yes too, request filed.

GLSA 200904-13