Bug 11723 - bip new security issue CVE-2013-4550
: bip new security issue CVE-2013-4550
Status: RESOLVED FIXED
Product: Mageia
Classification: Unclassified
Component: Security
: 3
: i586 Linux
: Normal Severity: normal
: ---
Assigned To: QA Team
: Sec team
: http://lwn.net/Vulnerabilities/574573/
: MGA2TOO has_procedure advisory mga2-3...
: validated_update
:
:
  Show dependency treegraph
 
Reported: 2013-11-21 16:40 CET by David Walser
Modified: 2014-01-02 23:42 CET (History)
2 users (show)

See Also:
Source RPM: bip-0.8.8-11.mga3.src.rpm
CVE:


Attachments
bip.conf (4.45 KB, text/x-log)
2013-11-22 12:15 CET, claire robinson
Details

Description David Walser 2013-11-21 16:40:13 CET
Fedora has issued an advisory on November 11:
https://lists.fedoraproject.org/pipermail/package-announce/2013-November/122274.html

The issue was fixed upstream in 0.8.9, and RedHat has linked the upstream patch.

Patched packages uploaded for Mageia 2, Mageia 3, and Cauldron.

Advisory:
========================

Updated bip package fixes security vulnerability:

bip 0.8.8 and earlier contains an issue where failed SSL handshakes result in a
resource leak. A remote attacker can use this flaw to cause bip to run out of
resources, resulting in a denial of service (CVE-2013-4550).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4550
https://lists.fedoraproject.org/pipermail/package-announce/2013-November/122274.html
========================

Updated packages in core/updates_testing:
========================
bip-0.8.8-5.3.mga2
bip-0.8.8-11.1.mga3

from SRPMS:
bip-0.8.8-5.3.mga2.src.rpm
bip-0.8.8-11.1.mga3.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 claire robinson 2013-11-22 11:41:32 CET
https://wiki.mageia.org/en/QA_procedure:Bip
Comment 2 claire robinson 2013-11-22 12:15:36 CET
Created attachment 4516 [details]
bip.conf

This is the bip.conf I'm using to test with. The login/password is mrsb/password on port 7778 and it'll join #mageia-qa as MrsBip2 so you might want to change those settings :)
Comment 3 claire robinson 2013-11-22 12:21:38 CET
When connecting to bip, for the server itself use the computer running bip and port 7778, then for the server password enter it as user:password:network

In the attached conf mine would be mrsb:password:freenode
Comment 4 claire robinson 2013-11-22 12:22:00 CET
Testing complete mga3 64
Comment 5 claire robinson 2013-11-22 12:41:45 CET
Testing complete mga2 64 and mga3 32
Comment 6 claire robinson 2013-11-22 13:30:47 CET
Testing complete mga2 32

Validating.


Could sysadmin please push from 2&3 core/updates_testing to updates

Thanks!
Comment 7 Thomas Backlund 2013-11-22 20:28:52 CET
Update pushed:
http://advisories.mageia.org/MGASA-2013-0351.html
Comment 8 David Walser 2014-01-02 23:42:35 CET
A second CVE was issued for another issue that was fixed with the same patch that fixed this issue.  CVE-2011-5268 was also fixed here:
http://openwall.com/lists/oss-security/2014/01/02/9

Note You need to log in before you can comment on or make changes to this bug.