[Forgot Password]
Login  Register Subscribe

23631

 
 

117918

 
 

98218

 
 

909

 
 

79224

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2012-3461

Date: (C)2012-08-20   (M)2017-11-18 


The (1) otrl_base64_otr_decode function in src/b64.c; (2) otrl_proto_data_read_flags and (3) otrl_proto_accept_data functions in src/proto.c; and (4) decode function in toolkit/parse.c in libotr before 3.2.1 allocates a zero-length buffer when decoding a base64 string, which allows remote attackers to cause a denial of service (application crash) via a message with the value "?OTR:===.", which triggers a heap-based buffer overflow.

CVSS Score: 4.3Access Vector: NETWORK
Exploit Score: 8.6Access Complexity: MEDIUM
Impact Score: 2.9Authentication: NONE
 Confidentiality: NONE
 Integrity: NONE
 Availability: PARTIAL





Reference:
BID-54907
DSA-2526
MDVSA-2012:131
MDVSA-2013:097
SUSE-SU-2012:1578
USN-1541-1
http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001348.html
http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684121
http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr;a=commitdiff;h=1902baee5d4b056850274ed0fa8c2409f1187435
http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr;a=commitdiff;h=6d4ca89cf1d3c9a8aff696c3a846ac5a51f762c1
http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr;a=commitdiff;h=b17232f86f8e60d0d22caf9a2400494d3c77da58
https://bugzilla.redhat.com/show_bug.cgi?id=846377
libotr-base64-bo(77528)
openSUSE-SU-2012:1525
openSUSE-SU-2013:0155

CPE    2
cpe:/a:cypherpunks:libotr:3.2.0
cpe:/a:cypherpunks:libotr:3.1.0
CWE    1
CWE-119
OVAL    7
oval:org.secpod.oval:def:104098
oval:org.secpod.oval:def:104096
oval:org.secpod.oval:def:302951
oval:org.secpod.oval:def:400447
...

© 2013 SecPod Technologies