russell@unturf.com 6784cdf1cf feat: add 39 outreach docs (batches 6-8)

Batch 6 (9): dolibarr, jitsi-videobridge, zed, tryton, suricata,
  strawberry, zulip, zesarux, zephyr
Batch 7 (15): xonotic (4), xash3d (3), xenia, xtuple, zabbix (2),
  zathura, zebra, yabause, zephyr-0001
Batch 8 (15): woodpecker (2), wine (4), widelands (3), wesnoth (3),
  wekan (3)

Mix of CWE-407 and CWE-312.

2026-04-14 17:06:28 -04:00

2.8 KiB

Raw Permalink Blame History

Yabause — CWE-312 Disclosure Brief (yabause-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One CWE-312 (Cleartext Storage of Sensitive Information) defect in Yabause Saturn emulator NetLink modem handling. NetlinkWriteByte logs plaintext login credentials (username and password) to debug output when NETLINK_DEBUG is enabled at compile time.

The Defect

yabause-0001 (PATCHED — MEDIUM): yabause/src/netlink.c:582,592

// In NetlinkWriteByte() — fires during modem login handshake:
// Line 582: logs login name verbatim
NETLINK_LOG("login response: %s", NetlinkArea->inbuffer+NetlinkArea->inbufferstart);

// Line 592: logs password verbatim
NETLINK_LOG("password response: %s", NetlinkArea->inbuffer+NetlinkArea->inbufferstart);

NETLINK_LOG expands to DebugPrintf(MainLog, ...), which writes to a persistent file-backed debug log (debug.h). During the Saturn NetLink modem PPP/shell login handshake, the emulator captures the ISP username and password exchanged with the remote server and writes both to the log in cleartext.

Impact

Yabause emulates the Sega Saturn NetLink modem for online dial-up sessions. Users testing with real legacy ISP credentials (Sega Net, NetLink ISP accounts) expose their authentication data in log files. On systems with serial console, UART shell, or logging backends that write to flash or network syslog, the credentials persist in cleartext. Debug builds distributed with crash reporting could include these credentials in uploaded logs.

The Fix

Replace verbatim credential strings with redacted placeholders that preserve diagnostic byte counts:

// Before
NETLINK_LOG("login response: %s", NetlinkArea->inbuffer+NetlinkArea->inbufferstart);
NETLINK_LOG("password response: %s", NetlinkArea->inbuffer+NetlinkArea->inbufferstart);

// After
// CWE-312 fix: redact credentials, preserve byte count for diagnostics.
NETLINK_LOG("login response: [REDACTED %d bytes]",
    (int)strlen(NetlinkArea->inbuffer+NetlinkArea->inbufferstart));
NETLINK_LOG("password response: [REDACTED %d bytes]",
    (int)strlen(NetlinkArea->inbuffer+NetlinkArea->inbufferstart));

Patch

Fix available: defects/yabause-0001/patch/yabause-0001.patch

Single-file patch on yabause/src/netlink.c. Redacts both login name and password log entries.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (Yabause/yabause).
Assess severity — exposes ISP credentials in debug logs during NetLink modem sessions.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the Yabause team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.8 KiB Raw Permalink Blame History