Denial of service in InspIRCd

1) NULL pointer dereference

EUVDB-ID: #VU46821

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20917

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in mysql module, when built against mariadb-connector-c 3.0.5 or newer.  A remote user can send specially crafted request to the InspIRCd daemon, trigger a NULL pointer dereference error and crash the server.

Successful exploitation of the vulnerability requires that sqlauth or sqloper modules are used.

Mitigation

Install update from vendor's website.

Vulnerable software versions

InspIRCd: 2.0.0 - 3.2.0

External links

http://docs.inspircd.org/security/2019-02/
http://github.com/inspircd/inspircd/commit/2cc35d8625b7ea5cbd1d1ebb116aff86c5280162
http://github.com/inspircd/inspircd/commit/8745660fcdac7c1b80c94cfc0ff60928cd4dd4b7
http://www.debian.org/security/2020/dsa-4764

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.