Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vectors.

Secunia reports :

Some security issues have been reported in BitlBee, which can be exploited by malicious people to bypass certain security restrictions and hijack accounts.

The security issues are caused due to unspecified errors, which can be exploited to overwrite existing accounts.

The remote host is affected by the vulnerability described in GLSA-200809-14 (BitlBee: Security bypass)

    Multiple unspecified vulnerabilities were reported, including a NULL     pointer dereference.
  Impact :

    A remote attacker could exploit these vulnerabilities to overwrite     existing IM accounts.
  Workaround :

    There is no known workaround at this time.

Upstream released Bitlbee 1.2.3 with the following changes to the former release: - Fixed one more flaw similar to the previous hijacking bug, caused by inconsistent handling of the USTATUS_IDENTIFIED state. All code touching these variables was reviewed and should be correct now. Finished 7 Sep 2008

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream released Bitlbee 1.2.2 with the following changes to the former release: - Security bugfix: It was possible to hijack accounts (without gaining access to the old account, it's simply an overwrite)
- Some more stability improvements. - Fixed bug where people with non-lowercase nicks couldn't drop their account. - Easier upgrades of non-forking daemon mode servers (using the DEAF command). - Can be cross-compiled for Win32 now! (No support for SSL yet though, which makes it less useful for now.) - Exponential backoff on auto-reconnect. - Changing passwords gives less confusing feedback ('password is empty') now. Finished 26 Aug 2008

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
34301	FreeBSD : bitlbee -- account recreation security issues (24ec781b-8c11-11dd-9923-0016d325a0ed)	Nessus	FreeBSD Local Security Checks	high
34272	GLSA-200809-14 : BitlBee: Security bypass	Nessus	Gentoo Local Security Checks	high
34176	Fedora 9 : bitlbee-1.2.3-1.fc9 (2008-7830)	Nessus	Fedora Local Security Checks	high
34145	Fedora 8 : bitlbee-1.2.2-1.fc8 (2008-7712)	Nessus	Fedora Local Security Checks	high
34102	Fedora 9 : bitlbee-1.2.2-1.fc9 (2008-7274)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-3920

critical

Tenable Plugins

high

high

high

high

high