CVE-2012-3461: Buffer Overflow
Multiple heap-based buffer overflow flaws were found in the way the Base64 decoder of libotr, an Off-The-Record Messaging library and toolkit, performed decoding of certain messages. A remote attacker could provide a specially-crafted OTR message that once processed in an application linked against libotr would lead to that application crash or, potentially, arbitrary code execution with the privileges of the user running the application.
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684121 [2] http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html
Relevant upstream patches: [3] http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr;a=commitdiff;h=b17232f86f8e60d0d22caf9a2400494d3c77da58 [4] http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr;a=commitdiff;h=6d4ca89cf1d3c9a8aff696c3a846ac5a51f762c1 [5] http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr;a=commitdiff;h=1902baee5d4b056850274ed0fa8c2409f1187435
Other sources
The (1) otrlbase64otrdecode function in src/b64.c; (2) otrlprotodatareadflags and (3) otrlprotoacceptdata functions in src/proto.c; and (4) decode function in toolkit/parse.c in libotr before 3.2.1 allocates a zero-length buffer when decoding a base64 string, which allows remote attackers to cause a denial of service (application crash) via a message with the value "?OTR:===.", which triggers a heap-based buffer overflow.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3461?
CVE-2012-3461 is classified as a high severity vulnerability due to its potential for remote code execution through heap-based buffer overflows.
How do I fix CVE-2012-3461?
To fix CVE-2012-3461, upgrade to a version of libotr that is higher than 3.2.0 or specifically update from version 3.1.0.
What versions of libotr are affected by CVE-2012-3461?
CVE-2012-3461 affects libotr versions up to and including 3.2.0 and also version 3.1.0.
Can CVE-2012-3461 be exploited remotely?
Yes, a remote attacker can exploit CVE-2012-3461 by sending specially-crafted OTR messages to an application using the vulnerable libotr library.
What types of applications are at risk for CVE-2012-3461?
Applications that link against the vulnerable versions of the libotr library are at risk for CVE-2012-3461.