IRSSI-SA-2018-02 Irssi Security Advisory [1]

CVE-2018-7054, CVE-2018-7053, CVE-2018-7050, CVE-2018-7052, CVE-2018-7051

Description

Multiple vulnerabilities have been located in Irssi.

  1. Use after free when server is disconnected during netsplits. Incomplete fix of CVE-2017-7191. Found by Joseph Bisch. (CWE-416, CWE-825)

    CVE-2018-7054 [2] was assigned to this issue.

  2. Use after free when SASL messages are received in unexpected order. Found by Joseph Bisch. (CWE-416, CWE-691)

    CVE-2018-7053 [3] was assigned to this issue.

  3. Null pointer dereference when an "empty" nick has been observed by Irssi. Found by Joseph Bisch. (CWE-476, CWE-475)

    CVE-2018-7050 [4] was assigned to this issue.

  4. When the number of windows exceed the available space, Irssi would crash due to Null pointer dereference. Found by Joseph Bisch. (CWE-690)

    CVE-2018-7052 [5] was assigned to this issue.

  5. Certain nick names could result in out of bounds access when printing theme strings. Found by Oss-Fuzz. (CWE-126)

    CVE-2018-7051 [6] was assigned to this issue.

Affected versions

  1. Irssi 1.0.0 and later

  2. Irssi 0.8.18 and later

  3. All Irssi versions that we observed

  4. All Irssi versions that we observed

  5. Irssi 0.8.7 and later

Fixed in

Irssi 1.0.7, 1.1.1

Upgrade to the latest stable Irssi version. Irssi 1.0.7 and 1.1.1 are maintenance release in the 1.0 and 1.1 series, without any new features.

After installing the updated packages, one can issue the /upgrade command to load the new binary. TLS connections will require /reconnect.

Mitigating facts

  2. requires a non-conforming ircd

  3. requires a broken ircd or control over the ircd

  4. depends on non-default configuration

References

  1. https://irssi.org/security/irssi_sa_2018_02.txt
  2. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7054
  3. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7053
  4. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7050
  5. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7052
  6. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7051