BitlBee multiple unspecified security bypass

bitlbee-multiple-unspecified-security-bypass (45132)

Medium Risk

Description:

Multiple unspecified vulnerabilities in BitlBee could allow a remote attacker to use unknown attack vectors to bypass security restrictions and possibly hijack sessions to overwrite existing accounts.

Platforms Affected:

• Bitlbee, Bitlbee 0.71
• Bitlbee, Bitlbee 0.72
• Bitlbee, Bitlbee 0.73
• Bitlbee, Bitlbee 0.74
• Bitlbee, Bitlbee 0.74 A
• Bitlbee, Bitlbee 0.80
• Bitlbee, Bitlbee 0.81 A
• Bitlbee, Bitlbee 0.81
• Bitlbee, Bitlbee 0.82
• Bitlbee, Bitlbee 0.83
• Bitlbee, Bitlbee 0.84
• Bitlbee, Bitlbee 0.85
• Bitlbee, Bitlbee 0.85 A
• Bitlbee, Bitlbee 0.90
• Bitlbee, Bitlbee 0.90 A
• Bitlbee, Bitlbee 0.91
• Bitlbee, Bitlbee 0.92
• Bitlbee, Bitlbee 0.93 A
• Bitlbee, Bitlbee 0.93
• Bitlbee, Bitlbee 0.99
• Bitlbee, Bitlbee 1.0
• Bitlbee, Bitlbee 1.0.1
• Bitlbee, Bitlbee 1.0.2
• Bitlbee, Bitlbee 1.0.3
• Bitlbee, Bitlbee 1.0.4
• Bitlbee, Bitlbee 1.1 Dev
• Bitlbee, Bitlbee 1.1.1 Dev
• BitlBee, BitlBee 1.1.1
• BitlBee, BitlBee 1.2
• BitlBee, BitlBee 1.2.1
• Gentoo, Linux

Remedy:

Upgrade to the latest version of BitlBee (1.2.3 or later), available from the BitlBee Web site. See References.

Consequences:

Bypass Security

References:

• BitlBee Changelog, Version 1.2.3 (released 2008-09-07) hilights at http://www.bitlbee.org/main.php/changelog.html.
• BitlBee News, 2008-09-07 14:24 UTC, BitlBee 1.2.3, unfortunately another important bugfix at http://www.bitlbee.org/main.php/news.r.html.
• BitlBee Web site, Download at http://bitlbee.org/main.php/download.html.
• oss-security Mailing List, Mon, 8 Sep 2008 09:36:08 +0200 , Re: CVE request for bitlbee at http://www.openwall.com/lists/oss-security/2008/09/08/1.
• oss-security Mailing List, Tue, 9 Sep 2008 10:39:37 -0400 (EDT) , Re: CVE request for bitlbee at http://www.openwall.com/lists/oss-security/2008/09/09/11.
• BID-31342: BitlBee Unspecified Security Bypass Variant Vulnerability
• CVE-2008-3969: Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to overwrite and hijack existing accounts via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2008-3920.
• GLSA-200809-14: BitlBee: Security bypass

Reported:

Sep 10, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page