BitlBee: Security bypass

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
net-im/bitlbee	< 1.2.3	>= 1.2.3	All supported architectures

Related bugreports: #236160

Multiple vulnerabilities in Bitlbee may allow to bypass security restrictions and hijack accounts.

2. Impact Information

BitlBee is an IRC to IM gateway that support multiple IM protocols.

Multiple unspecified vulnerabilities were reported, including a NULL pointer dereference.

A remote attacker could exploit these vulnerabilities to overwrite existing IM accounts.

3. Resolution Information

There is no known workaround at this time.

All BitlBee users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/bitlbee-1.2.3"

4. References

Updated September 23, 2008

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.