Description
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | quassel | 0.9.2-1 | — |
| Debian 13 | quassel | 0.9.2-1 | — |
| Debian 12 | quassel | 0.9.2-1 | — |
References
- https://github.com/quassel/quassel/commit/a1a24da
- openSUSE-SU-2013:1929 vendor-advisory
- [oss-security] 20131127 Re: CVE Request: Quassel IRC - manipulated clients can access backlog of all users on a shared core mailing-list
- http://quassel-irc.org/node/123
- quasselirc-cve20136404-sec-bypass(89377) vdb-entry
- 55640 third-party-advisory
- openSUSE-SU-2014:0114 vendor-advisory
- 100432 vdb-entry