Input validation error in ngIRCd - CVE-2013-1747
Published: March 29, 2013 / Updated: August 11, 2020
Vulnerability identifier: #VU42938
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2013-1747
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Barton, Alexander
Affected software:
ngIRCd
ngIRCd
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
channel.c in ngIRCd 20 and 20.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a KICK command for a user who is not on the associated channel.
How to mitigate CVE-2013-1747
Install update from vendor's website.
Sources
- http://arthur.barton.de/pipermail/ngircd-ml/2013-February/000623.html
- http://arthur.barton.de/pipermail/ngircd-ml/2013-February/000625.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101706.html
- http://ngircd.barton.de/doc/NEWS
- http://secunia.com/advisories/52982
- http://www.osvdb.com/show/osvdb/91836
- https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git;h=0e63fb3fa7ac4ca048e8c2b648d2be3fd0572311