Bug 406015 – <net-im/kadu-0.11.1 : Stored XSS by parsing contact's status and sms messages in history (CVE-2012-1410)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Michael Harrison 2012-02-27 10:48:36 UTC]

A stored cross-site scripting (XSS) flaw was found in the way Kadu, the instant
messenger compatible with the Gadu-Gadu protocol, performed sanitization of
status and sms messages for particular contact in user's history. A remote
attacker could provide a specially-crafted status or sms message, which would
be stored in victim's Kadu history file, if the attacker was present on the
contact list of the victim and the victim has had storage of statuses enabled
for their history file. When the victim later examined the content of the
status history, this flaw could lead to arbitrary HTML or webscript execution.

References:
[1] https://bugzilla.novell.com/show_bug.cgi?id=749036

Upstream patches:
[2]
https://gitorious.org/kadu/kadu/commit/ebe3674cf0f3aa9b36308c06e19cb293cc790b52
    (patch for the XSS issue)

[3]
https://gitorious.org/kadu/kadu/commit/e9506be6d3dcdd408fdf83d8eb82416c9b798c84
    (additional hardening)

[4]
https://gitorious.org/kadu/kadu/commit/91772e46541e22cbc2c7bf41a1a9798c2a58f6d6
    (disable xhtmlrequests)

[5]
https://gitorious.org/kadu/kadu/commit/94e7479617d78a1649a0763960edade7ad09a0d0
    (allow only GET and HEADER requests, additional hardening)

[Comment 1 Michael Harrison 2012-02-28 16:40:35 UTC]

My apologies for the mail spam. There was some confusion between oss-security and mitre.org assigning cves.

[Comment 2 GLSAMaker/CVETool Bot 2012-03-01 01:04:42 UTC]

CVE-2012-1410 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1410):
  Multiple cross-site scripting (XSS) vulnerabilities in the History Window
  implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject
  arbitrary web script or HTML via a crafted (1) SMS message, (2) presence
  message, or (3) status description.

[Comment 3 Maciej Mrozowski 2012-03-05 20:04:04 UTC]

Fixed in upstream release kadu-0.11.1, which is now in tree.

[Comment 4 Agostino Sarubbo 2012-03-05 20:19:43 UTC]

Arches, please test and mark stable:                                                                                                                                                
=net-im/kadu-0.11.1                                                                                                                                                                 
Target KEYWORDS : "amd64 ppc x86"

[Comment 5 Agostino Sarubbo 2012-03-07 12:52:06 UTC]

amd64 stable

[Comment 6 Brent Baude (RETIRED) 2012-03-10 17:04:26 UTC]

ppc done

[Comment 7 Paweł Hajdan, Jr. (RETIRED) 2012-03-15 18:11:03 UTC]

x86 stable

[Comment 8 Tim Sammut (RETIRED) 2012-03-15 20:31:57 UTC]

Thanks, everyone. Closing noglsa for XSS.