IRSSI-SA-2016 Irssi Security Advisory [1]

heap corruption and missing boundary checks

CVE-2016-7044, CVE-2016-7045

Description

Gabriel Campana and Adrien Guinet from Quarkslab reported two remote crash and heap corruption vulnerabilites in Irssi`s format parsing code.

They also provided us with proof of concept exploit code and patches to fix those issues.

  1. Remote crash and heap corruption in format parsing code found by Gabriel Campana and Adrien Guinet from Quarkslab. (CWE-20, CWE-823, CWE-126, CWE-122)

    CVE-2016-7044 [2] was assigned to this issue.

  2. Remote crash and heap corruption in format parsing code found by Gabriel Campana and Adrien Guinet from Quarkslab. (CWE-20, CWE-823, CWE-126, CWE-122)

    CVE-2016-7045 [3] was assigned to this issue.

Impact

Remote crash and heap corruption. Remote code execution seems difficult since only Nuls are written.

Affected versions

  1. Irssi 0.8.17 and later, only when compiled with true-color enabled.

  2. Irssi 0.8.17 and later

Fixed in

Irssi 0.8.20

Upgrade to Irssi 0.8.20. Irssi 0.8.20 is a maintenance release without any new features.

After installing the updated packages, one can issue the /upgrade command to load the new binary. TLS connections will require /reconnect.

Fallback action

Distributions which need to remain on Irssi 0.8.17 are strongly urged to apply the patch and provide updated packages.

Those who cannot upgrade right now, but with Perl support enabled in their Irssi, can load the following script and add it to ~/.irssi/scripts/autorun as a first aid to mitigating these issues:

https://irssi.org/security/sa_patch.pl

Patch

irssi/irssi@295a4b77f...

Discussion

Based on analysis Provided by Gabriel Campana and Adrien Guinet from Quarkslab.

  1. Bug 1

    The unformat_24bit_color() function is called by format_send_to_gui() to decode 24bit color codes into their components. The pointer is advanced unconditionally without checking if a complete code was supplied.

    Thus, after the return of unformat_24bit_color(), ptr might be invalid and point out of the buffer.

  2. Bug 2

    The format_send_to_gui() function does not validate the length of the string before incrementing the ptr pointer in all cases.

    If that happens, the pointer ptr can be incremented twice and thus end past the boundaries of the original dup buffer.

References

  1. https://irssi.org/security/irssi_sa_2016.txt
  2. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7044
  3. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7045