CVE-2015-8702 The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\03...
HighCVSS 8.6
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/inspircd(Debian:12) | < 2.0.20-1 | 2.0.20-1 |
| debian/inspircd(Debian:13) | < 2.0.20-1 | 2.0.20-1 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| inspircd | <= 2.0.18 | No fix listed |
References
- Debian Security Tracker CVE-2015-8702 vendor-advisory
- DSA-3527 vendor-advisory
- www.inspircd.org vendor-advisory
- github.com exploit
- github.com exploit
- GLSA-201512-13 vendor-advisory