Bug 797777 (CVE-2012-1410)

Summary:	CVE-2012-1410 kadu: Stored XSS by parsing contact's status and sms messages in history
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gajownik, radoslaw.lisowski
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-19 21:52:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2012-02-27 09:44:25 UTC

A stored cross-site scripting (XSS) flaw was found in the way Kadu, the instant messenger compatible with the Gadu-Gadu protocol, performed sanitization of status and sms messages for particular contact in user's history. A remote attacker could provide a specially-crafted status or sms message, which would be stored in victim's Kadu history file, if the attacker was present on the contact list of the victim and the victim has had storage of statuses enabled for their history file. When the victim later examined the content of the status history, this flaw could lead to arbitrary HTML or webscript execution.

References:
[1] https://bugzilla.novell.com/show_bug.cgi?id=749036

Upstream patches:
[2] https://gitorious.org/kadu/kadu/commit/ebe3674cf0f3aa9b36308c06e19cb293cc790b52
    (patch for the XSS issue)

[3] https://gitorious.org/kadu/kadu/commit/e9506be6d3dcdd408fdf83d8eb82416c9b798c84
    (additional hardening)

[4] https://gitorious.org/kadu/kadu/commit/91772e46541e22cbc2c7bf41a1a9798c2a58f6d6
    (disable xhtmlrequests)

[5] https://gitorious.org/kadu/kadu/commit/94e7479617d78a1649a0763960edade7ad09a0d0
    (allow only GET and HEADER requests, additional hardening)

Comment 1 Jan Lieskovsky 2012-02-27 10:12:24 UTC

The current versions of kadu package, as shipped with Fedora release of 15 and 16 (kadu-0.6.5.4-5.fc15) are NOT affected by this issue. But in -testing repositories we already have kadu-0.10.1-2.fc16 and kadu-0.10.1-2.fc15 and particular upstream patch [2] is already applicable to these (-testing versions).

Radoslaw, when upgrading kadu versions, could you please ensure, we would upgrade to upstream versions, which already have this flaw corrected? (the latest upstream kadu version, available for download seems to be v0.11.0 from:
[6] http://www.kadu.im/w/English:Download

and that one doesn't seem to have above patches applied yet).

So could you ensure, we would upgrade to corrected version already? (or upgrade to v0.11.0 and apply the patches above)

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Comment 2 Jan Lieskovsky 2012-02-27 10:13:59 UTC

Putting into NEEDINFO due previous comment (so it won't get unnoticed).

Comment 3 Jan Lieskovsky 2012-02-27 10:16:43 UTC

As of right now, it's not clear if CVE identifier has been assigned to this issue already or not. Thus asked at: http://www.openwall.com/lists/oss-security/2012/02/27/3 to clarify this. Once CVE identifier for this issue has been allocated, this bugzilla entry will be updated with particular id.

Comment 4 Kurt Seifried 2012-02-29 21:33:12 UTC

CVE assigned as per http://seclists.org/oss-sec/2012/q1/518