---
name: BUF-PL-SA-2016
heading: information disclosure vulnerability in buf.pl
affected_note: buf.pl
release_date: 2016-09-09
git_commit: f1b1eb154baa684fad5d65bf4dff79c8ded8b65a
repo: scripts.irssi.org
bugs:
  -
    cve: CVE-2016-7553
    cwe: CWE-732, CWE-538
    exploitable_by: local
    affected_versions:
      to: '2.13'
    fixed_version: '2.20'
    credit: 'Juerd Waalboer'
    description: 'Information disclosure vulnerability'
    impact: >
      Other users on the same machine may be able to retrieve the whole
      window contents after /UPGRADE when the buf.pl script is
      loaded. Furthermore, this dump of the windows contents is never
      removed afterwards.

      Since buf.pl is also an Irssi core script and we recommended its use
      to retain your window content, many people could potentially be
      affected by this.

      Remote users may be able to retrieve these contents when combined with
      other path traversal vulnerabilities in public facing services on that
      machine.
    discussion: >
      buf.pl restores the scrollbuffer between "/upgrade"s by writing the
      contents to a file, and reading that after the new process was spawned.
      Through that file, the contents of (private) chat conversations may leak to
      other users.
    mitigating_info: >
      Careful users with a limited umask (e.g. 077) are not affected by this bug.
      However, most Linux systems default to a umask of 022, meaning that files
      written without further restricting the permissions, are readable by any
      user.
description: >
  An information disclosure vulnerability was found, reported and fixed
  in the buf.pl script by its author.
recommended_action: >
  Update the buf.pl script with the latest version from
  https://scripts.irssi.org

---