SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Instant Messaging/IRC/Chat)  >   Irssi Vendors:   Irssi.org
Irssi Buffer Overflow in Processing Files in unformat_24bit_color() and format_send_to_gui() Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1036868
SecurityTracker URL:  http://securitytracker.com/id/1036868
CVE Reference:   CVE-2016-7044, CVE-2016-7045   (Links to External Site)
Date:  Sep 22 2016
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 0.8.17-beta to prior to 0.8.20
Description:   Two vulnerabilities were reported in Irssi. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted file that, when loaded by the target application, will trigger a buffer overflow in unformat_24bit_color() and execute arbitrary code on the target system [CVE-2016-7044]. The code will run with the privileges of the target application.

A remote user can create a specially crafted file that, when loaded by the target application, will trigger a buffer overflow in format_send_to_gui() and execute arbitrary code on the target system [CVE-2016-7044]. The code will run with the privileges of the target application.

Gabriel Campana and Adrien Guinet from Quarkslab reported these vulnerabilities.

Impact:   A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fix (0.8.20).

The vendor advisory is available at:

https://irssi.org/security/irssi_sa_2016.txt

Vendor URL:  irssi.org/security/irssi_sa_2016.txt (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Sep 22 2016 (Ubuntu Issues Fix) Irssi Buffer Overflow in Processing Files in unformat_24bit_color() and format_send_to_gui() Lets Remote Users Execute Arbitrary Code
Ubuntu has issued a fix for Ubuntu Linux 16.04 LTS.



 Source Message Contents

Subject:  [oss-security] Irssi Security Advisory CVE-2016-7044+CVE-2016-7045

We are sad to have to announce the following security issue:

Canonical URL http://irssi.org/security/irssi_sa_2016.txt

heap corruption and missing boundary checks
===========================================
CWE Classification: CWE-20, CWE-823, CWE-126, CWE-122

CVE-2016-7044 [1] was assigned to bug 1
CVE-2016-7045 [2] was assigned to bug 2


Description
-----------

Gabriel Campana and Adrien Guinet from Quarkslab reported two remote
crash and heap corruption vulnerabilites in Irssi's format parsing
code.

They also provided us with proof of concept exploit code and patches
to fix those issues.


Impact
------

Remote crash and heap corruption. Remote code execution seems
difficult since only Nuls are written.


Detailed analysis
-----------------

Based on analysis Provided by Gabriel Campana and Adrien Guinet from
Quarkslab:

Bug 1

The unformat_24bit_color() function is called by format_send_to_gui()
to decode 24bit color codes into their components. The pointer is
advanced unconditionally without checking if a complete code was
supplied.

Thus, after the return of unformat_24bit_color(), ptr might be invalid
and point out of the buffer.

Bug 2

The format_send_to_gui() function does not validate the length of the
string before incrementing the `ptr' pointer in all cases.

If that happens, the pointer `ptr' can be incremented twice and thus
end past the boundaries of the original `dup' buffer.


Affected versions
-----------------

Irssi 0.8.17-beta up to and including 0.8.19 up to 0.8.19-219-g52fedea

Bug 1 affects only Irssis compiled with true-color enabled.
Bug 2 affects all Irssis regardless of compilation flags.


Fixed in
--------

Irssi 0.8.20


Recommended action
------------------

Upgrade to Irssi 0.8.20. Irssi 0.8.20 is a maintenance release
without any new features.

After installing the updated packages, one can issue the /upgrade
command to load the new binary. TLS connections will require
/reconnect. If the buf.pl script is loaded and symlinked into
~/.irssi/scripts/autorun, text buffer content will be saved and
restored.


Fallback action
---------------

Distributions which need to remain on Irssi 0.8.17 are strongly urged
to apply the patch and provide updated packages.

Those totally unable to upgrade, but with Perl support enabled in
their Irssi, can load the following script and add it to
~/.irssi/scripts/autorun as a first aid to mitigating these issues: 

https://irssi.org/security/sa_patch.pl


Patch
-----

https://github.com/irssi/irssi/commit/295a4b77f07f14602eeaa371f00ddbf09
910c82b


References
----------
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7044
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7045
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC