[Secure-testing-team] Bug#838762: irssi: information disclosure vulnerabilit in buf.pl (CWE-732, CWE-538)

[Holger Levsen]

Package: irssi
Version: 0.8.20
Severity: important
Tags: security patch upstream

Hi,

as discussed on irc, it seems irssi in Debian is still affected by
https://irssi.org/2016/09/22/buf.pl-update/

To quote from there:

---beginn---
buf.pl update available

Posted on September 22nd 2016 

An information disclosure vulnerability was found, reported and fixed in the buf.pl script by its author.

CWE Classification: CWE-732, CWE-538
Impact

Other users on the same machine may be able to retrieve the whole window contents after /UPGRADE when the buf.pl script is loaded. Furthermore, this dump of the windows contents is never removed afterwards.

Since buf.pl is also an Irssi core script and we recommended its use to retain your window content, many people could potentially be affected by this.

Remote users may be able to retrieve these contents when combined with other path traversal vulnerabilities in public facing services on that machine.
Detailed analysis

buf.pl restores the scrollbuffer between “/upgrade”s by writing the contents to a file, and reading that after the new process was spawned. Through that file, the contents of (private) chat conversations may leak to other users.
Mitigating facts

Careful users with a limited umask (e.g. 077) are not affected by this bug. However, most Linux systems default to a umask of 022, meaning that files written without further restricting the permissions, are readable by any user.
Affected versions

All up to 2.13
Fixed versions

buf.pl 2.20
Resolution

Update the buf.pl script with the latest version from scripts.irssi.org.

---end---

Thanks for maintaining irssi!


-- 
cheers,
	Holger
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 811 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20160924/79ba926d/attachment.sig>