Ubuntu
ngircd package

[CVE-2007-6062] Denial of service via JOIN command without channel

Bug #173164 reported by William Grant
256
Affects Status Importance Assigned to Milestone
ngircd (Debian)
Fix Released
Unknown
ngircd (Ubuntu)
Fix Released
Undecided
Unassigned
Dapper
Invalid
Undecided
William Grant
Edgy
Invalid
Undecided
William Grant
Feisty
Fix Released
Undecided
William Grant
Gutsy
Fix Released
Undecided
William Grant
Hardy
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: ngircd

irc-channel.c in ngIRCd before 0.10.3 allows remote attackers to cause a denial of service (crash) via a JOIN command without a channel argument.

Hardy already has 0.10.3.

William Grant (wgrant)
Changed in ngircd:
assignee: nobody → fujitsu
status: New → In Progress
assignee: nobody → fujitsu
status: New → In Progress
assignee: nobody → fujitsu
status: New → In Progress
assignee: nobody → fujitsu
status: New → In Progress
status: New → Fix Released
Revision history for this message
William Grant (wgrant) wrote :

Dapper and Edgy have extra checks that must have been removed in 0.10.0; they're not vulnerable.

Changed in ngircd:
status: In Progress → Invalid
status: In Progress → Invalid
Revision history for this message
William Grant (wgrant) wrote :
Revision history for this message
William Grant (wgrant) wrote :
Revision history for this message
Kees Cook (kees) wrote :

Thanks for preparing this! I've uploaded it to the security queue; it should be published shortly.

Changed in ngircd:
status: In Progress → Fix Committed
status: In Progress → Fix Committed
Revision history for this message
William Grant (wgrant) wrote :

ngircd (0.10.0-3ubuntu0.7.10) gutsy-security; urgency=low

  * SECURITY UPDATE: Denial of service via crafted JOIN command. (LP: #173164)
  * debian/patches/05-CVE-2007-6062.dpatch: Check that there is at least one
    argument to the JOIN command.
  * References:
    CVE-2007-6062

 -- William Grant <email address hidden> Sat, 01 Dec 2007 12:26:23 +1100

Revision history for this message
William Grant (wgrant) wrote :

ngircd (0.10.0-3ubuntu0.7.04) feisty-security; urgency=low

  * SECURITY UPDATE: Denial of service via crafted JOIN command. (LP: #173164)
  * debian/patches/05-CVE-2007-6062.dpatch: Check that there is at least one
    argument to the JOIN command.
  * References:
    CVE-2007-6062

 -- William Grant <email address hidden> Sat, 01 Dec 2007 12:12:51 +1100

Changed in ngircd:
status: Fix Committed → Fix Released
status: Fix Committed → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in ngircd:
status: Unknown → New
Bug Watch Updater (bug-watch-updater)
Changed in ngircd:
status: New → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.