Fedora 8 : bitlbee-1.2.2-1.fc8 (2008-7712)

This script is Copyright (C) 2008-2015 Tenable Network Security, Inc.


Synopsis :

The remote Fedora host is missing a security update.

Description :

Upstream released Bitlbee 1.2.2 with the following changes to the
former release: - Security bugfix: It was possible to hijack accounts
(without gaining access to the old account, it's simply an overwrite)
- Some more stability improvements. - Fixed bug where people with
non-lowercase nicks couldn't drop their account. - Easier upgrades of
non-forking daemon mode servers (using the DEAF command). - Can be
cross-compiled for Win32 now! (No support for SSL yet though, which
makes it less useful for now.) - Exponential backoff on
auto-reconnect. - Changing passwords gives less confusing feedback
('password is empty') now. Finished 26 Aug 2008

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.redhat.com/show_bug.cgi?id=460355
http://www.nessus.org/u?d8430f3a

Solution :

Update the affected bitlbee package.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: Fedora Local Security Checks

Nessus Plugin ID: 34145 (fedora_2008-7712.nasl)

Bugtraq ID:

CVE ID: CVE-2008-3920

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now