oss-sec mailing list archives
Remote DoS Vulnerability in bitchx, ircii < 20210314 and scrollz
From: ortmann () posteo de
Date: Tue, 23 Mar 2021 23:41:27 +0100
Hi, i discovered a remote DoS vulnerability (crash) that effects bitchx, ircii and scrollz. Its unknown if this could also be used for arbitrary code execution. Affected Versions: This bug is very old and affects any version, except ircii-20210314, which got a fix. CVE Name: none yet Problem Description: ircii has a bug in parsing CTCP UTC messages. bitchx and scrollz are forks of ircii and inherited that feature and bug. Impact: A malicious irc user could nuke any other irc user that uses bitchx, ircii or scrollz out of irc (crash their irc client) by connecting to the same irc network and sending a malicious CTCP UTC message. Solution: For ircii: Update to ircii-20210314 For bitchx and scrollz: none yet History: 20210302 Vulnerability and PoC reported to: bitchx - security () bitchx org ircii - mrg () eterna com au scrollz - flier () scrollz info 20210314 ircii released a fixed version light and love, Michael Ortmann
Current thread:
- Remote DoS Vulnerability in bitchx, ircii < 20210314 and scrollz ortmann (Mar 24)
- Re: Remote DoS Vulnerability in bitchx, ircii < 20210314 and scrollz ortmann (Mar 30)