The (1) otrl_base64_otr_decode function in src/b64.c; (2) otrl_proto_data_read_flags and (3) otrl_proto_accept_data functions in src/proto.c; and (4) decode function in toolkit/parse.c in libotr before 3.2.1 allocates a zero-length buffer when decoding a base64 string, which allows remote attackers to cause a denial of service (application crash) via a message with the value "?OTR:===.", which triggers a heap-based buffer overflow.

The remote Solaris system is missing necessary patches to address security updates :

  - The (1) otrl_base64_otr_decode function in src/b64.c;
    (2) otrl_proto_data_read_flags and (3)     otrl_proto_accept_data functions in src/ proto.c; and     (4) decode function in toolkit/parse.c in libotr before     3.2.1 allocates a zero-length buffer when decoding a     base64 string, which allows remote attackers to cause a     denial of service (application crash) via a message with     the value '?OTR:===.', which triggers a heap-based     buffer overflow. (CVE-2012-3461)

This update of libotr fixed multiple buffer overflows.

The remote host is affected by the vulnerability described in GLSA-201309-07 (libotr: Arbitrary code execution)

    Multiple heap-based buffer overflows are present in the Base64 decoder       of libotr.
  Impact :

    A remote attacker could send a specially crafted OTR message, resulting       in arbitrary code execution with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

A vulnerability was found and corrected in libotr :

Just Ferguson discovered that libotr, an off-the-record (OTR) messaging library, can be forced to perform zero-length allocations for heap buffers that are used in base64 decoding routines. An attacker can exploit this flaw by sending crafted messages to an application that is using libotr to perform denial of service attacks or potentially execute arbitrary code (CVE-2012-3461).

The updated packages have been patched to correct this issue.

This update fixes various heap overflows in libotr. CVE-2012-3461 has been assigned to this issue.

Updated to 3.2.1, updates patch for rhbz#846377, CVE-2012-3461

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated to 3.2.1, updates patch for rhbz#846377, CVE-2012-3461 Patch for multiple heap-based buffer overflows in the Base64 decoder

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated to 3.2.1, updates patch for rhbz#846377, CVE-2012-3461 Patch for multiple heap-based buffer overflows in the Base64

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

OTR developers report :

The otrl_base64_otr_decode() function and similar functions within OTR suffer from buffer overflows in the case of malformed input;
specifically if a message of the format of '?OTR:===.' is received then a zero-byte allocation is performed without a similar correlation between the subsequent base64 decoding write, as such it becomes possible to write between zero and three bytes incorrectly to the heap, albeit only with a value of '='.

Because this code path is highly utilized, specifically in the reception of instant messages over pidgin or similar, this vulnerability is considered severe even though in many platforms and circumstances the bug would yield an unexploitable state and result simply in denial of service.

The developers of OTR promptly fixed the errors and users of OTR are advised to upgrade the software at the next release cycle.

Justin Ferguson discovered multiple heap overflows in libotr. A remote attacker could use this to craft a malformed OTR message that could cause a denial of service via application crash or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Just Ferguson discovered that libotr, an off-the-record (OTR) messaging library, can be forced to perform zero-length allocations for heap buffers that are used in base64 decoding routines. An attacker can exploit this flaw by sending crafted messages to an application that is using libotr to perform denial of service attacks or potentially execute arbitrary code.

ID	Name	Product	Family	Severity
80673	Oracle Solaris Third-Party Patch Update : libotr (cve_2012_3461_denial_of)	Nessus	Solaris Local Security Checks	medium
74817	openSUSE Security Update : libotr (openSUSE-SU-2012:1525-1)	Nessus	SuSE Local Security Checks	medium
69898	GLSA-201309-07 : libotr: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
66109	Mandriva Linux Security Advisory : libotr (MDVSA-2013:097)	Nessus	Mandriva Local Security Checks	medium
64187	SuSE 11.2 Security Update : libotr (SAT Patch Number 7076)	Nessus	SuSE Local Security Checks	medium
63072	SuSE 10 Security Update : libotr (ZYPP Patch Number 8377)	Nessus	SuSE Local Security Checks	medium
62128	Fedora 18 : libotr-3.2.1-1.fc18 (2012-11900)	Nessus	Fedora Local Security Checks	medium
61980	Mandriva Linux Security Advisory : libotr (MDVSA-2012:131)	Nessus	Mandriva Local Security Checks	medium
61669	Fedora 17 : libotr-3.2.1-1.fc17 (2012-11959)	Nessus	Fedora Local Security Checks	medium
61668	Fedora 16 : libotr-3.2.1-1.fc16 (2012-11934)	Nessus	Fedora Local Security Checks	medium
61589	FreeBSD : libotr -- buffer overflows (c651c898-e90d-11e1-b230-0024e830109b)	Nessus	FreeBSD Local Security Checks	medium
61570	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : libotr vulnerability (USN-1541-1)	Nessus	Ubuntu Local Security Checks	medium
61495	Debian DSA-2526-1 : libotr - heap-based buffer overflows	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-3461

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium