Gentoo: GLSA-202107-22: InspIRCd: Information disclosure | LinuxSec...
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 202107-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Low
    Title: InspIRCd: Information disclosure
     Date: July 09, 2021
     Bugs: #791589
       ID: 202107-22

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

An information disclosure vulnerability in InspIRCd may allow remote
attackers to obtain sensitive information.

Background
==========

InspIRCd is a modular Internet Relay Chat (IRC) server written in C++
which was created from scratch to be stable, modern and lightweight.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  net-irc/inspircd             < 3.10.0                  >= 3.10.0

Description
===========

InspIRCd incorrectly handled malformed PONG messages, resulting in
access of freed memory.

Impact
======

A remote attacker could send crafted packets to the server, possibly
allowing them to obtain sensitive information.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All InspIRCd users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=net-irc/inspircd-3.10.0"

References
==========

[ 1 ] CVE-2021-33586
      https://nvd.nist.gov/vuln/detail/CVE-2021-33586

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202107-22

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2021 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo: GLSA-202107-22: InspIRCd: Information disclosure

Summary

InspIRCd incorrectly handled malformed PONG messages, resulting in access of freed memory.

Resolution

All InspIRCd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/inspircd-3.10.0"

References

[ 1 ] CVE-2021-33586 https://nvd.nist.gov/vuln/detail/CVE-2021-33586

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202107-22

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to [email protected] or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
Severity: Low
Title: InspIRCd: Information disclosure
Date: July 09, 2021
Bugs: #791589
ID: 202107-22

Synopsis

An information disclosure vulnerability in InspIRCd may allow remote attackers to obtain sensitive information.

Background

InspIRCd is a modular Internet Relay Chat (IRC) server written in C++ which was created from scratch to be stable, modern and lightweight.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-irc/inspircd < 3.10.0 >= 3.10.0

Impact

A remote attacker could send crafted packets to the server, possibly allowing them to obtain sensitive information.

Workaround

There is no known workaround at this time.

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.