4.3

CVE-2013-5580

The (1) Conn_StartLogin and (2) cb_Read_Resolver_Result functions in conn.c in ngIRCd 18 through 20.2, when the configuration option NoticeAuth is enabled, does not properly handle the return code for the Handle_Write function, which allows remote attackers to cause a denial of service (assertion failure and server crash) via unspecified vectors, related to a "notice auth" message not being sent to a new client.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Barton ≫ Ngircd Version18.0
Barton ≫ Ngircd Version19.0
Barton ≫ Ngircd Version19.1
Barton ≫ Ngircd Version20.0
Barton ≫ Ngircd Version20.1
Barton ≫ Ngircd Version20.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.32% 0.812
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git%3Ba=commit%3Bh=309122017ebc6fff039a7cab1b82f632853d82d5
http://arthur.barton.de/pipermail/ngircd-ml/2013-August/000645.html
http://freecode.com/projects/ngircd/releases/357245
Patch
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115047.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115077.html
http://osvdb.org/96590
http://secunia.com/advisories/54567
Vendor Advisory