Menu
Patch closes security hole in messaging encryption tool

Patch closes security hole in messaging encryption tool

The up-to-date version of the component, libotr, is 4.1.1

A software component for encrypting instant messaging clients has a flaw that could let attackers take over users' machines, but there's now a patch for the vulnerability.

The vulnerability is contained in libotr, short for OTR Messaging Library and Toolkit. The up-to-date version is now 4.1.1.

OTR stands for Off-the-Record Messaging. It's a a cryptographic protocol that scrambles messages sent through clients including Pidgin, ChatSecure and Adium.

The integer overflow flaw was found by Markus Vervier of the German company X41 D-Sec, which released an advisory

"This flaw could potentially be exploited by a remote attacker to cause a heap buffer overflow and subsequently for arbitrary code to be executed on the user's machine," X41 D-Sec wrote.

The company found the flaw during a manual code review. It can be exploited by sending a very large message from one client to another, which causes an integer overflow that leads to a heap overflow on 64-bit architectures, X41 D-Sec wrote.

The message sent must be more than 5.5 GB. That's huge, but OTR allows for sending fragmented messages that are then assembled by libotr, the company wrote.

"Sending such a message to a Pidgin client took only a few minutes on a fast network connection without visible signs of any attack to a user," it wrote.

The latest version of libotr can be downloaded here.


Follow Us

Join the newsletter!

Error: Please check your email address.

Featured

Slideshows

Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Show Comments