Your message dated Sat, 24 Sep 2016 19:19:16 +0200 with message-id <[email protected]> and subject line fixed in 0.8.20-2 has caused the Debian Bug report #838762, regarding irssi: information disclosure vulnerability in buf.pl (CWE-732, CWE-538) to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 838762: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838762 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: irssi Version: 0.8.20 Severity: important Tags: security patch upstream Hi, as discussed on irc, it seems irssi in Debian is still affected by https://irssi.org/2016/09/22/buf.pl-update/ To quote from there: ---beginn--- buf.pl update available Posted on September 22nd 2016 An information disclosure vulnerability was found, reported and fixed in the buf.pl script by its author. CWE Classification: CWE-732, CWE-538 Impact Other users on the same machine may be able to retrieve the whole window contents after /UPGRADE when the buf.pl script is loaded. Furthermore, this dump of the windows contents is never removed afterwards. Since buf.pl is also an Irssi core script and we recommended its use to retain your window content, many people could potentially be affected by this. Remote users may be able to retrieve these contents when combined with other path traversal vulnerabilities in public facing services on that machine. Detailed analysis buf.pl restores the scrollbuffer between “/upgrade”s by writing the contents to a file, and reading that after the new process was spawned. Through that file, the contents of (private) chat conversations may leak to other users. Mitigating facts Careful users with a limited umask (e.g. 077) are not affected by this bug. However, most Linux systems default to a umask of 022, meaning that files written without further restricting the permissions, are readable by any user. Affected versions All up to 2.13 Fixed versions buf.pl 2.20 Resolution Update the buf.pl script with the latest version from scripts.irssi.org. ---end--- Thanks for maintaining irssi! -- cheers, Holger
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---Version: 0.8.20-2 Hi, forgot to add the closes to the changelog: * New patch 23fix-buf.pl to fix an information exposure issue involved with using buf.pl and /upgrade. Thanks, Rhonda -- Fühlst du dich mutlos, fass endlich Mut, los | Fühlst du dich hilflos, geh raus und hilf, los | Wir sind Helden Fühlst du dich machtlos, geh raus und mach, los | 23.55: Alles auf Anfang Fühlst du dich haltlos, such Halt und lass los |
--- End Message ---
