Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 249481 (CVE-2007-4960) - games-simulation/secondlife-bin Login mechanism data disclosure (CVE-2007-{4960,4961})
Summary: games-simulation/secondlife-bin Login mechanism data disclosure (CVE-2007-{49...
Alias: CVE-2007-4960
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High enhancement (vote)
Assignee: Gentoo Security
Whiteboard: ~4 [upstream?]
Depends on:
Reported: 2008-12-01 13:54 UTC by Robert Buchholz (RETIRED)
Modified: 2008-12-11 09:27 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Robert Buchholz (RETIRED) gentoo-dev 2008-12-01 13:54:22 UTC
CVE-2007-4960 (
  Argument injection vulnerability in the Linden Lab Second Life
  secondlife:// protocol handler, as used in Internet Explorer and
  possibly Firefox, allows remote attackers to obtain sensitive
  information via a '" ' (double-quote space) sequence followed by the
  -autologin and -loginuri arguments, which cause the handler to post
  login credentials and software installation details to an arbitrary

CVE-2007-4961 (
  The login_to_simulator method in Linden Lab Second Life, as used by
  the secondlife:// protocol handler and possibly other Second Life
  login mechanisms, sends an MD5 hash in cleartext in the passwd field,
  which allows remote attackers to login to an account by sniffing the
  network and then sending this hash to a Second Life authentication
Comment 1 Robert Buchholz (RETIRED) gentoo-dev 2008-12-01 13:58:08 UTC
According to both Secunia and OSVDB these issues seem to be unfixed. I did not confirm this myself, but it might be worthwhile to check or contact upstream for a statement.

Joe: is listed in metadata.xml, but does not have a bugzilla account.
Comment 2 Toei Rei 2008-12-01 16:23:29 UTC
1) LL Bug in their tracker:
2) As we don't 'dobin' the script, so it doesn't get executed and we don't handle the secondlife:// protocol
Comment 3 Joe Peterson (RETIRED) gentoo-dev 2008-12-11 09:22:18 UTC
Hi, take a look at comment #2 - I think this can be closed.
Comment 4 Pierre-Yves Rofes (RETIRED) gentoo-dev 2008-12-11 09:27:36 UTC
ok, closing as invalid then.