VulnerabilityModified
CVE-2008-3969
Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of…
MEDIUM 5.0EPSS 2.41%
Does this matter?
Lower severity and a low EPSS score (2.41%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for CVE-2008-3920.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 2.41% probability · 83th percentile
- CISA KEV
- Not listed
- Affected
- bitlbee/bitlbee · fedoraproject/fedora
- Source
- secalert@redhat.com
References
- http://secunia.com/advisories/31690Third Party Advisory
- http://secunia.com/advisories/31991Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200809-14.xmlThird Party Advisory
- http://www.bitlbee.org/main.php/changelog.htmlRelease Notes, Vendor Advisory
- http://www.bitlbee.org/main.php/news.r.htmlRelease Notes, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2008/09/08/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2008/09/09/11Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/31342Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=461424Issue Tracking, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45132Third Party Advisory, VDB Entry
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.htmlThird Party Advisory
- http://secunia.com/advisories/31690Third Party Advisory
- http://secunia.com/advisories/31991Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200809-14.xmlThird Party Advisory
- http://www.bitlbee.org/main.php/changelog.htmlRelease Notes, Vendor Advisory
- http://www.bitlbee.org/main.php/news.r.htmlRelease Notes, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2008/09/08/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2008/09/09/11Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/31342Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=461424Issue Tracking, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45132Third Party Advisory, VDB Entry
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.