CVE-2009-4652 The (1) Conn_GetCipherInfo and (2) Conn_UsesSSL functions in src/ngircd/conn.c in ngIRCd 13 and 14, when SSL/TLS support is present and standalone mode is disabled, allow remote attackers to cause a d...
LowCVSS 2.6
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) Conn_GetCipherInfo and (2) Conn_UsesSSL functions in src/ngircd/conn.c in ngIRCd 13 and 14, when SSL/TLS support is present and standalone mode is disabled, allow remote attackers to cause a denial of service (application crash) by sending the MOTD command from another server in the same IRC network, possibly related to an array index error.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ngircd | = 13 | No fix listed |
| ngircd | = 14 | No fix listed |
| debian/ngircd(Debian:12) | < 15-0.1 | 15-0.1 |
| debian/ngircd(Debian:13) | < 15-0.1 | 15-0.1 |
| debian/ngircd(Debian:14) | < 15-0.1 | 15-0.1 |
References
- arthur.barton.de
- arthur.barton.de
- ngircd.barton.de
- ngircd.barton.de vendor-advisory
- 37343 third-party-advisory vendor-advisory
- 37021 exploit vdb-entry
- ADV-2009-3240 vdb-entry vendor-advisory
- ngircd-ssltls-dos(54272) vdb-entry
- Debian Security Tracker CVE-2009-4652 vendor-advisory