Bug 12158 - libgadu new security issue CVE-2013-4488
Summary: libgadu new security issue CVE-2013-4488
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/578238/
Whiteboard: MGA3TOO has_procedure advisory MGA3-3...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2013-12-30 18:31 CET by David Walser
Modified: 2014-09-15 12:37 CEST (History)
6 users (show)

See Also:
Source RPM: libgadu-1.11.2-6.mga4.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2013-12-30 18:31:02 CET
Fedora has issued an advisory on December 12:
https://lists.fedoraproject.org/pipermail/package-announce/2013-December/125143.html

This issue has been known for a while, and given that it requires upgrading the library from 1.11.2 to the 1.12 branch (which is still only at RC stage), I'd think we can hold off on this until 1.12 goes final and it can be properly QA tested after Mageia 4 is out.  Hopefully the library major doesn't change, but if it does we'll have to rebuild some packages (kadu, perl-Nat-Gadu, kdenetwork4, and ekg2).

Reproducible: 

Steps to Reproduce:
David Walser 2013-12-30 18:31:09 CET

Whiteboard: (none) => MGA3TOO

David Walser 2014-02-05 19:09:01 CET

CC: (none) => fundawang, n54

David Walser 2014-02-05 19:09:13 CET

Whiteboard: MGA3TOO => MGA4TOO, MGA3TOO

Comment 1 David Walser 2014-08-13 21:36:04 CEST
1.12.0 final is now out and it doesn't change the library major, so that's good.

It has a build-time test suite (make check) which fails when built with gnutls support (which we do) on the "connect" test saying buffer overflow detected.
Comment 2 David Walser 2014-09-05 22:59:06 CEST
libgadu-1.12.0-1.mga5 uploaded for Cauldron (with out make check) by diogenese.  The make check has been added in SVN, we'll see if it builds on the build system when it's pushed again...

CC: (none) => warrendiogenese
Version: Cauldron => 4
Whiteboard: MGA4TOO, MGA3TOO => MGA3TOO

Comment 3 David Walser 2014-09-10 02:43:42 CEST
Updated packages uploaded for Mageia 3 and Mageia 4.

The RedHat bug mentions OpenSSL, but Fedora's package is built with gnutls,
not OpenSSL, same as ours.  Looking at the code commits they linked, it doesn't look like the issue is only when using OpenSSL.

Advisory:
========================

Updated libgadu packages fix security vulnerability:

Libgadu before 1.12.0 was found to not be performing SSL certificate
validation (CVE-2013-4488).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4488
https://lists.fedoraproject.org/pipermail/package-announce/2013-December/125143.html
========================

Updated packages in core/updates_testing:
========================
libgadu3-1.12.0-1.mga3
libgadu-devel-1.12.0-1.mga3
libgadu3-1.12.0-1.mga4
libgadu-devel-1.12.0-1.mga4

from SRPMS:
libgadu-1.12.0-1.mga3.src.rpm
libgadu-1.12.0-1.mga4.src.rpm

Assignee: bugsquad => qa-bugs

Comment 4 David Walser 2014-09-10 02:44:02 CEST
Testing procedure:
https://bugs.mageia.org/show_bug.cgi?id=12709

Whiteboard: MGA3TOO => MGA3TOO has_procedure

Comment 5 Samuel Verschelde 2014-09-10 14:30:37 CEST
Testing MGA4 64

Just testing that the lib installs and is correctly loaded by the ekg2 client.

# urpmi lib64gadu3 --search-media "Updates Testing"
# urpmi ekg2

then

$ strace -o strace.out ekg2 # then type "quit" and then press enter
$ grep libgadu strace.out 
open("/lib64/libgadu.so.3", O_RDONLY|O_CLOEXEC) = 6

Testing complete.

CC: (none) => stormi
Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure MGA4-64-OK

Comment 6 William Kenney 2014-09-10 19:26:27 CEST
In VirtualBox, M3, KDE, 32-bit

Package(s) under test:
libgadu3 ekg2

default install of libgadu3 & ekg2

[root@localhost wilcal]# urpmi libgadu3
Package libgadu3-1.11.4-1.mga3.i586 is already installed
[root@localhost wilcal]# urpmi ekg2
Package ekg2-0.3.1-8.mga3.i586 is already installed

[wilcal@localhost ~]$ strace -o strace.out ekg2
EKG2 launches
Quit EKG2
[wilcal@localhost ~]$ grep libgadu strace.out
open("/lib/libgadu.so.3", O_RDONLY|O_CLOEXEC) = 6

install libgadu3 from updates_testing

[root@localhost wilcal]# urpmi libgadu3
Package libgadu3-1.12.0-1.mga3.i586 is already installed
[root@localhost wilcal]# urpmi ekg2
Package ekg2-0.3.1-8.mga3.i586 is already installed

[wilcal@localhost ~]$ strace -o strace.out ekg2
EKG2 launches
Quit EKG2
[wilcal@localhost ~]$ grep libgadu strace.out
open("/lib/libgadu.so.3", O_RDONLY|O_CLOEXEC) = 6

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64

CC: (none) => wilcal.int

Comment 7 William Kenney 2014-09-10 19:26:44 CEST
In VirtualBox, M3, KDE, 64-bit

Package(s) under test:
lib64gadu3 ekg2

default install of lib64gadu3 & ekg2

[root@localhost wilcal]# urpmi lib64gadu3
Package lib64gadu3-1.11.4-1.mga3.x86_64 is already installed
[root@localhost wilcal]# urpmi ekg2
Package ekg2-0.3.1-8.mga3.x86_64 is already installed

[wilcal@localhost ~]$ strace -o strace.out ekg2
EKG2 launches
Quit EKG2
[wilcal@localhost ~]$ grep libgadu strace.out
open("/lib64/libgadu.so.3", O_RDONLY|O_CLOEXEC) = 6

install lib64gadu3 from updates_testing

[root@localhost wilcal]# urpmi lib64gadu3
Package lib64gadu3-1.12.0-1.mga3.x86_64 is already installed
[root@localhost wilcal]# urpmi ekg2
Package ekg2-0.3.1-8.mga3.x86_64 is already installed

[wilcal@localhost ~]$ strace -o strace.out ekg2
EKG2 launches
Quit EKG2
[wilcal@localhost ~]$ grep libgadu strace.out
open("/lib/libgadu.so.3", O_RDONLY|O_CLOEXEC) = 6

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64
William Kenney 2014-09-10 19:27:00 CEST

Whiteboard: MGA3TOO has_procedure MGA4-64-OK => MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-64-OK

Comment 8 William Kenney 2014-09-10 19:39:10 CEST
In VirtualBox, M4, KDE, 32-bit

Package(s) under test:
libgadu3 ekg2

default install of libgadu3 & ekg2

[root@localhost wilcal]# urpmi libgadu3
Package libgadu3-1.11.4-1.mga4.i586 is already installed
[root@localhost wilcal]# urpmi ekg2
Package ekg2-0.3.1-10.mga4.i586 is already installed

[wilcal@localhost ~]$ strace -o strace.out ekg2
EKG2 launches
Quit EKG2
[wilcal@localhost ~]$ grep libgadu strace.out
open("/lib/libgadu.so.3", O_RDONLY|O_CLOEXEC) = 6

install libgadu3 from updates_testing

[root@localhost wilcal]# urpmi libgadu3
Package libgadu3-1.12.0-1.mga4.i586 is already installed
[root@localhost wilcal]# urpmi ekg2
Package ekg2-0.3.1-10.mga4.i586 is already installed

[wilcal@localhost ~]$ strace -o strace.out ekg2
EKG2 launches
Quit EKG2
[wilcal@localhost ~]$ grep libgadu strace.out
open("/lib/libgadu.so.3", O_RDONLY|O_CLOEXEC) = 6

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64

Whiteboard: MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-64-OK => MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK

Comment 9 William Kenney 2014-09-10 19:39:58 CEST
For me this update works fine.
Testing complete for mga3 32-bit & 64-bit
Testing complete for mga4 32-bit & 64-bit
Validating the update.
Could someone from the sysadmin team push this to updates.
Thanks

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 10 claire robinson 2014-09-12 14:24:26 CEST
Advisory uploaded.

Whiteboard: MGA3TOO has_procedure MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK => MGA3TOO has_procedure advisory MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK

Comment 11 Mageia Robot 2014-09-15 12:37:11 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0375.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.