Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 249481 (CVE-2007-4960)

Summary: games-simulation/secondlife-bin Login mechanism data disclosure (CVE-2007-{4960,4961})
Product: Gentoo Security Reporter: Robert Buchholz (RETIRED) <rbu>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED INVALID    
Severity: enhancement CC: gbugs, lavajoe
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://www.gnucitizen.org/blog/ie-pwns-secondlife
Whiteboard: ~4 [upstream?]
Package list:
Runtime testing required: ---

Description Robert Buchholz (RETIRED) gentoo-dev 2008-12-01 13:54:22 UTC
CVE-2007-4960 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4960):
  Argument injection vulnerability in the Linden Lab Second Life
  secondlife:// protocol handler, as used in Internet Explorer and
  possibly Firefox, allows remote attackers to obtain sensitive
  information via a '" ' (double-quote space) sequence followed by the
  -autologin and -loginuri arguments, which cause the handler to post
  login credentials and software installation details to an arbitrary
  URL.

CVE-2007-4961 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4961):
  The login_to_simulator method in Linden Lab Second Life, as used by
  the secondlife:// protocol handler and possibly other Second Life
  login mechanisms, sends an MD5 hash in cleartext in the passwd field,
  which allows remote attackers to login to an account by sniffing the
  network and then sending this hash to a Second Life authentication
  server.
Comment 1 Robert Buchholz (RETIRED) gentoo-dev 2008-12-01 13:58:08 UTC
According to both Secunia and OSVDB these issues seem to be unfixed. I did not confirm this myself, but it might be worthwhile to check or contact upstream for a statement.

Joe: toei.rei@stargazer.at is listed in metadata.xml, but does not have a bugzilla account.
Comment 2 Toei Rei 2008-12-01 16:23:29 UTC
1) LL Bug in their tracker: http://jira.secondlife.com/browse/VWR-2508
2) As we don't 'dobin' the register_secondlifeprotocol.sh script, so it doesn't get executed and we don't handle the secondlife:// protocol
Comment 3 Joe Peterson (RETIRED) gentoo-dev 2008-12-11 09:22:18 UTC
Hi, take a look at comment #2 - I think this can be closed.
Comment 4 Pierre-Yves Rofes (RETIRED) gentoo-dev 2008-12-11 09:27:36 UTC
ok, closing as invalid then.