CVE-2016-7553
Description
The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow local users to obtain sensitive information from private chat conversations by reading the file.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2016-7553
Vendor advisory: security@debian.org — https://irssi.org/security/buf_pl_sa_2016.txt
Vendor advisory: security@debian.org — https://github.com/irssi/scripts.irssi.org/commit/f1b1eb154baa684fad5d65bf4dff79c8ded8b65a
Vendor advisory: security@debian.org — http://www.openwall.com/lists/oss-security/2016/09/26/4
Vendor advisory: security@debian.org — http://www.openwall.com/lists/oss-security/2016/09/24/1
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 0.8.20-2 |
| debian | bullseye | fixed | 0.8.20-2 |
| debian | forky | fixed | 0.8.20-2 |
| debian | sid | fixed | 0.8.20-2 |
| debian | trixie | fixed | 0.8.20-2 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| irssi | buf.pl | {"endIncluding":"2.13"} | |
References
- http://www.openwall.com/lists/oss-security/2016/09/24/1
- http://www.openwall.com/lists/oss-security/2016/09/26/4
- http://www.securityfocus.com/bid/93155
- https://github.com/irssi/scripts.irssi.org/commit/f1b1eb154baa684fad5d65bf4dff79c8ded8b65a
- https://irssi.org/security/buf_pl_sa_2016.txt
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OM3WHWQ7RIAOZSOZZUM4CUYGKSIAGJJ/
- https://security-tracker.debian.org/tracker/CVE-2016-7553
CWEs
CWE-275
Verify integrity in audit chain (admin only). AS-IS.