[ MDVSA-2010:079 ] irssi

[dude67]

_______________________________________________________________________

Package : irssi
Date : April 17, 2010
Affected: 2009.1, 2010.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been found and corrected in irssi:

Irssi before 0.8.15, when SSL is used, does not verify that the server
hostname matches a domain name in the subject's Common Name (CN)
field or a Subject Alternative Name field of the X.509 certificate,
which allows man-in-the-middle attackers to spoof IRC servers via an
arbitrary certificate (CVE-2010-1155).

core/nicklist.c in Irssi before 0.8.15 allows remote attackers to cause
a denial of service (NULL pointer dereference and application crash)
via vectors related to an attempted fuzzy nick match at the instant
that a victim leaves a channel (CVE-2010-1156).

Additionally the updated packages disables the SSLv2 protocol and
enables the SSLv3 and TLSv1 protocols for added security.

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2010-1155
http://cve.mitre.org/cgi-bin/cvename.cg ... -2010-1156
_______________________________________________________________________