BitlBee Unspecified Security Bypass Variant Vulnerability

Bugtraq ID:	31342
Class:	Design Error
CVE:	CVE-2008-3969
Remote:	Yes
Local:	No
Published:	Sep 07 2008 12:00AM
Updated:	Sep 25 2008 05:29PM
Credit:	BitlBee
Vulnerable:	Gentoo Linux BitlBee BitlBee 1.2.2 BitlBee BitlBee 1.2.1 BitlBee BitlBee 1.2
Not Vulnerable:	BitlBee BitlBee 1.2.3

BitlBee Unspecified Security Bypass Variant Vulnerability

BitlBee is prone to an unspecified security-bypass vulnerability.

Successfully exploiting this issue may allow attackers to recreate or hijack user accounts on the system. Gaining access to these accounts may aid in further attacks.

Versions prior to BitlBee 1.2.3 are vulnerable.

NOTE: This issue is similar to the vulnerability discussed in BID 30858 (BitlBee Unspecified Security Bypass Vulnerability) and may be caused by an incomplete fix for that issue.

BitlBee Unspecified Security Bypass Variant Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

BitlBee Unspecified Security Bypass Variant Vulnerability

Solution:
The vendor has released updates and an advisory. Please see the references for more information.


BitlBee BitlBee 1.2

• BitlBee bitlbee-1.2.3.tar.gz
  http://get.bitlbee.org/src/bitlbee-1.2.3.tar.gz

BitlBee BitlBee 1.2.1

• BitlBee bitlbee-1.2.3.tar.gz
  http://get.bitlbee.org/src/bitlbee-1.2.3.tar.gz

BitlBee BitlBee 1.2.2

• BitlBee bitlbee-1.2.3.tar.gz
  http://get.bitlbee.org/src/bitlbee-1.2.3.tar.gz

BitlBee Unspecified Security Bypass Variant Vulnerability

References:

• BitlBee Change Log (BitlBee)
  
• BitlBee Homepage (BitlBee)