Test ID:	1.3.6.1.4.1.25623.1.0.71822
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2526-1)
Summary:	The remote host is missing an update for the Debian 'libotr' package(s) announced via the DSA-2526-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'libotr' package(s) announced via the DSA-2526-1 advisory. Vulnerability Insight: Just Ferguson discovered that libotr, an off-the-record (OTR) messaging library, can be forced to perform zero-length allocations for heap buffers that are used in base64 decoding routines. An attacker can exploit this flaw by sending crafted messages to an application that is using libotr to perform denial of service attacks or potentially execute arbitrary code. For the stable distribution (squeeze), this problem has been fixed in version 3.2.0-2+squeeze1. For the testing distribution (wheezy), this problem has been fixed in version 3.2.1-1. For the unstable distribution (sid), this problem has been fixed in version 3.2.1-1. We recommend that you upgrade your libotr packages. Affected Software/OS: 'libotr' package(s) on Debian 6. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-3461 54907 http://www.securityfocus.com/bid/54907 DSA-2526 http://www.debian.org/security/2012/dsa-2526 MDVSA-2012:131 http://www.mandriva.com/security/advisories?name=MDVSA-2012:131 MDVSA-2013:097 http://www.mandriva.com/security/advisories?name=MDVSA-2013:097 SUSE-SU-2012:1578 http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00019.html USN-1541-1 http://www.ubuntu.com/usn/USN-1541-1 [OTR-dev] 20120727 Re: otrl_base64_otr_decode() function... http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001348.html [OTR-dev] 20120727 otrl_base64_otr_decode() function... http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684121 http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr%3Ba=commitdiff%3Bh=1902baee5d4b056850274ed0fa8c2409f1187435 http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr%3Ba=commitdiff%3Bh=6d4ca89cf1d3c9a8aff696c3a846ac5a51f762c1 http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr%3Ba=commitdiff%3Bh=b17232f86f8e60d0d22caf9a2400494d3c77da58 https://bugzilla.redhat.com/show_bug.cgi?id=846377 libotr-base64-bo(77528) https://exchange.xforce.ibmcloud.com/vulnerabilities/77528 openSUSE-SU-2012:1525 http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00016.html openSUSE-SU-2013:0155 http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00019.html
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.