Created attachment 667926 [details]
2015-01-intoverflow.patch

EMBARGOED via distros
CRD: 2016-03-09 18:00 UTC


[This advisory is under embargo.  I would like to lift the embargo on
Wed Mar 9, at 1:00 pm EST = 18h00 UTC.  Do speak up quickly if that's
not enought time for you.  The new versions are live at the URLs below,
though not yet linked to from anywhere.  The git repository does *not*
contain the fix at this time.  I am also attaching the patch to prevent
it from being email-munged.]



Off-the-Record Messaging (OTR) Security Advisory 2016-01

Integer overflow vulnerability in libotr

Versions 4.1.0 and earlier of libotr in 64-bit builds contain an integer
overflow security flaw.  This flaw could potentially be exploited by a
remote attacker to cause a heap buffer overflow and subsequently for
arbitrary code to be executed on the user's machine.

In several places in proto.c, the sizes of portions of incoming messages
were stored in variables of type int or unsigned int instead of size_t.
If a message arrives with very large sizes (for example unsigned int
datalen = UINT_MAX), then constructions like malloc(datalen+1) will turn
into malloc(0), which on some architectures returns a non-NULL pointer,
but UINT_MAX bytes will get written to that pointer.

The reporter has requested a CVE for this issue, but it has not yet been
assigned.

The recommended course of action is to upgrade libotr to version
4.1.1 immediately.  The new version can be obtained here:

Source code:
    https://otr.cypherpunks.ca/libotr-4.1.1.tar.gz
gpg signature:
    https://otr.cypherpunks.ca/libotr-4.1.1.tar.gz.asc

git repository:
    git://git.otr.im/libotr.git (tag 4.1.1)

A new Windows binary of pidgin-otr (4.0.2) linked to libotr 4.1.1 is
available; however, as the Windows version is a 32-bit build, it is not
susceptible to the above flaw.  Windows users may wish to upgrade in any
event in order to take advantages of other fixes in libotr 4.1.1 and
pidgin-otr 4.0.2, however (see the respective NEWS files).

pidgin-otr 4.0.2 Source code:
    https://otr.cypherpunks.ca/pidgin-otr-4.0.2.tar.gz
gpg signature:
    https://otr.cypherpunks.ca/pidgin-otr-4.0.2.tar.gz.asc

Windows installer:
    https://otr.cypherpunks.ca/binaries/windows/pidgin-otr-4.0.2.exe
gpg signature:
    https://otr.cypherpunks.ca/binaries/windows/pidgin-otr-4.0.2.exe.asc

Windows zip file:
    https://otr.cypherpunks.ca/binaries/windows/pidgin-otr-4.0.2.zip
gpg signature:
    https://otr.cypherpunks.ca/binaries/windows/pidgin-otr-4.0.2.zip.asc


Linux and *BSD vendors and package maintainers have been notified, and
updated packages should be available from them.

If upgrading to version 4.1.1 is not possible, please apply the
following patch to 4.1.0:

(attached)