Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 23 Apr 2008 12:12:08 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re:  CVE Request: inspircd


On Tue, 22 Apr 2008, Micah Anderson wrote:

>
> Versions prior to 1.1.17 of InspIRCd are vulnerable to a remotely
> triggerable buffer overflow which can lead to a Denial of Service
> (daemon crash) when the namesx and uhnames modules are loaded.

The reference you pointed to is for a fix in 1.1.18, which suggests that
1.1.17 is vulnerable.

Thanks for the clarification of the issue - the vendor's post only alluded
to "security" with no additional details, which left a lot of vuln DBs
guessing.

- Steve

======================================================
Name: CVE-2008-1925
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1925
Reference: MISC:http://www.inspircd.org/bugtrack/view_bug.php?bug_id=438
Reference: CONFIRM:http://www.inspircd.org/forum/showthread.php?t=2945
Reference: MLIST:[oss-security] 20080422 CVE Request: inspircd
Reference: URL:http://www.openwall.com/lists/oss-security/2008/04/22/3
Reference: FRSIRT:ADV-2008-1041
Reference: URL:http://www.frsirt.com/english/advisories/2008/1041/references
Reference: SECUNIA:29610
Reference: URL:http://secunia.com/advisories/29610

Buffer overflow in InspIRCd before 1.1.18, when using the namesx and
uhnames modules, allows remote attackers to cause a denial of service
(daemon crash) via a large number of channel users with crafted
nicknames, idents, and long hostnames.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.