CVE-2017-5668
📋 TL;DR
CVE-2017-5668 is a critical vulnerability in bitlbee-libpurple that allows remote attackers to trigger a NULL pointer dereference, causing denial of service and potentially executing arbitrary code. This affects users of bitlbee-libpurple versions before 3.5.1 who accept file transfer requests from untrusted contacts.
💻 Affected Systems
- bitlbee-libpurple
📦 What is this software?
Bitlbee by Bitlbee
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Denial of service through application crash, disrupting instant messaging services.
If Mitigated
No impact if patched or if file transfers are disabled from unknown contacts.
🎯 Exploit Status
Exploit requires sending file transfer request to contact not in contact list. Public exploit details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.1
Vendor Advisory: https://bugs.bitlbee.org/ticket/1282
Restart Required: Yes
Instructions:
1. Update bitlbee-libpurple to version 3.5.1 or later using package manager. 2. Restart bitlbee service. 3. Verify version with 'bitlbee -v'.
🔧 Temporary Workarounds
Disable file transfers from unknown contacts
linuxConfigure bitlbee to reject file transfer requests from contacts not in your contact list
Edit bitlbee config to set 'file_transfers = false' or restrict to trusted contacts only
🧯 If You Can't Patch
- Disable bitlbee service entirely until patching possible
- Implement network segmentation to isolate bitlbee instances from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check bitlbee version with 'bitlbee -v' or 'dpkg -l | grep bitlbee' and verify if below 3.5.1Check Version:
bitlbee -vVerify Fix Applied:
Confirm version is 3.5.1 or higher and test file transfer functionality📡 Detection & Monitoring
Log Indicators:
- Application crashes with NULL pointer dereference errors
- Unexpected file transfer request logs from unknown contacts
Network Indicators:
- File transfer protocol requests to bitlbee instances from unexpected sources
SIEM Query:
source="bitlbee.log" AND ("segmentation fault" OR "NULL pointer" OR "file transfer from unknown")🔗 References
- http://www.openwall.com/lists/oss-security/2017/01/30/4
- http://www.openwall.com/lists/oss-security/2017/01/31/11
- http://www.securityfocus.com/bid/95932
- https://bugs.bitlbee.org/ticket/1282
- https://github.com/bitlbee/bitlbee/commit/30d598ce7cd3f136ee9d7097f39fa9818a272441
- http://www.openwall.com/lists/oss-security/2017/01/30/4
- http://www.openwall.com/lists/oss-security/2017/01/31/11
- http://www.securityfocus.com/bid/95932
- https://bugs.bitlbee.org/ticket/1282
- https://github.com/bitlbee/bitlbee/commit/30d598ce7cd3f136ee9d7097f39fa9818a272441
