Security bugs are reported here via bugzilla

[George Sherwood <pilot AT beernabeer.com>]

Synopsis
========
A critical security vulnerability has been found in bitlbee versions <
1.2.3 and > 1.0.x.

Background
==========
BitlBee brings IM (instant messaging) to IRC clients. It's a great
solution for people who have an IRC client running all the time and
don't want to run an additional MSN/AIM/whatever client.

Description
===========
I just released BitlBee 1.2.2, and I advice public server maintainers
to upgrade their BitlBee daemons as soon as possible, since this
release fixes a security bug that was probably there for a long time
already.

It's not a serious bug, it doesn't allow anyone to compromise your
server. It does allow people to hijack accounts, though. Not with
gaining access to the IM accounts or settings of the existing user, it
only allows people to recreate an existing account. Unfortunately 1.2.2
did not fix all possible account hijacking loopholes. Another very
similar flaw was found by Tero Marttila. In the migration to the user
configuration storage abstraction layer, a few safeguards that prevent
overwriting existing accounts disappeared.[0]

Affected packages
=================
These vulnerabilities were reported for bitlbee < 1.2.3. Bitlbee in
all grimoires is affected by this vulnerability.

This is now fixed in test, and will soon be in the stable grimoire.

Resolution
==========
All bitlbee users should upgrade to the latest available version:
# scribe update
# cast -c bitlbee

If you maintain your own installation of bitlbee ouside of sorcery,
there are  patches available from upstream.

References
==========
[0] http://www.bitlbee.org/main.php/news.r.html

Attachment: signature.asc
Description: PGP signature