Clients may be able to access buffers belonging to other users

[Scott Kitterman]

A manipulated, but properly authenticated client was able to retrieve
the backlog of other users on the same core in some cases by providing
an appropriate BufferID to the storage engine. Note that proper
authentication was still required, so exploiting this requires
malicious users on your core.

Fixed upstream in 0.9.2.

[Launchpad Janitor (janitor)]

This bug was fixed in the package quassel - 0.9.2-0ubuntu1

---------------
quassel (0.9.2-0ubuntu1) trusty; urgency=low

  * New upstream release
    - Includes fix for cross-user data exposure in the core (LP: #1255362)
 -- Scott Kitterman <email address hidden> Tue, 26 Nov 2013 19:56:06 -0500

[Felix Geyer (debfx)]

CVE-2013-6404 has been assigned to this vulnerability.

[Felix Geyer (debfx)]

Scott, any news on this?
Do you want me to take over preparing the updates?

[Felix Geyer (debfx)]

I've prepared and tested updates for precise, quantal and saucy.

[Marc Deslauriers (mdeslaur)]

ACK on the debdiffs, they are currently building and will be released once done.

Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package quassel - 0.8.0-0ubuntu2.1

---------------
quassel (0.8.0-0ubuntu2.1) quantal-security; urgency=low

  * SECURITY UPDATE: clients can access backlogs belonging to other users
    - debian/patches/CVE-2013-6404.patch: add upstream patch
    - CVE-2013-6404
    - LP: #1255362
 -- Felix Geyer <email address hidden> Thu, 16 Jan 2014 21:44:27 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package quassel - 0.9.1-0ubuntu1.1

---------------
quassel (0.9.1-0ubuntu1.1) saucy-security; urgency=low

  * SECURITY UPDATE: clients can access backlogs belonging to other users
    - debian/patches/CVE-2013-6404.patch: add upstream patch
    - CVE-2013-6404
    - LP: #1255362
 -- Felix Geyer <email address hidden> Thu, 16 Jan 2014 21:46:04 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package quassel - 0.8.0-0ubuntu1.1

---------------
quassel (0.8.0-0ubuntu1.1) precise-security; urgency=low

  * SECURITY UPDATE: clients can access backlogs belonging to other users
    - debian/patches/CVE-2013-6404.patch: add upstream patch
    - CVE-2013-6404
    - LP: #1255362
 -- Felix Geyer <email address hidden> Thu, 16 Jan 2014 21:34:52 +0100