blob: 410d0110ae13fee6b1f37f439890ea7fcf90034d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
---
layout: post
title: "buf.pl update available"
---
An information disclosure vulnerability was found, reported and fixed
in the buf.pl script by its author.
CWE Classification: CWE-732, CWE-538
### Impact
Other users on the same machine may be able to retrieve the whole
window contents after /UPGRADE when the buf.pl script is
loaded. Furthermore, this dump of the windows contents is never
removed afterwards.
Since buf.pl is also an Irssi core script and we recommended its use
to retain your window content, many people could potentially be
affected by this.
Remote users may be able to retrieve these contents when combined with
other path traversal vulnerabilities in public facing services on that
machine.
### Detailed analysis
buf.pl restores the scrollbuffer between "/upgrade"s by writing the
contents to a file, and reading that after the new process was spawned.
Through that file, the contents of (private) chat conversations may leak to
other users.
### Mitigating facts
Careful users with a limited umask (e.g. 077) are not affected by this bug.
However, most Linux systems default to a umask of 022, meaning that files
written without further restricting the permissions, are readable by any
user.
### Affected versions
All up to 2.13
### Fixed versions
[buf.pl](//scripts.irssi.org/scripts/buf.pl) 2.20
### Resolution
Update the buf.pl script with the latest version from
[scripts.irssi.org](//scripts.irssi.org).
|
