USN-8977-1: bitlbee vulnerabilities
It was discovered that BitlBee incorrectly handled file transfer connections that expired when built with libpurple. A remote attacker could possibly use this issue to cause BitlBee to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-10188)
It was discovered that BitlBee incorrectly handled file transfer requests for contacts that were not in the contact list. A remote attacker could possibly use this issue to cause BitlBee to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-10189)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/bitlbeeto a version that resolves this vulnerability.Fixed in 3.4.2-0ubuntu1+esm1 - Upgrade
Upgrade
ubuntu/bitlbee-libpurpleto a version that resolves this vulnerability.Fixed in 3.4.2-0ubuntu1+esm1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which BitlBee deployments are exposed to these issues?
The affected file-transfer handling issues apply to BitlBee when it is built with libpurple. The listed affected software includes Ubuntu packages for bitlbee and bitlbee-libpurple.
What would an attacker need to do to trigger the vulnerabilities?
An attacker would need to interact with BitlBee's file-transfer functionality. One issue involves an expired file-transfer connection, and the other involves a file-transfer request from a contact that is not in the contact list.
What is the potential impact if exploitation succeeds?
A remote attacker may be able to crash BitlBee, causing a denial of service. The advisory also states that arbitrary code execution may be possible.