search menu icon-carat-right cmu-wordmark

CERT Coordination Center

InspIRCd heap corruption vulnerability

Vulnerability Note VU#212651

Original Release Date: 2012-03-19 | Last Revised: 2012-04-09

Overview

InspIRCd 2.0.5 and possibly other versions contain a heap corruption vulnerability that may be exploited with a specifically crafted DNS query.

Description

InspIRCd contains a heap corruption vulnerability that exists in the dns.cpp code. The res[] buffer is allocated on the heap and can be overflowed. The res[] buffer can be exploited during its deallocation. The number of overflowed bytes can be controlled with DNS compression features.

Impact

A remote unauthenticated attacker may be able to execute arbitrary code with the permissions of the user running the InspIRCd service.

Solution

Apply an Update

InspIRCd 1.2.9 RC1, 2.0.6 RC1, and 2.1.0 B3 have addressed this vulnerability.

Configuration Change

The issue may be mitigated in some scenarios by changing your configuration file so <performance:nouserdns> is set to yes.

Vendor Information

212651
 
Affected   Unknown   Unaffected

InspIRCd

Notified:  February 06, 2012 Updated:  March 19, 2012

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

SUSE Linux

Notified:  February 07, 2012 Updated:  February 13, 2012

Status

  Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Debian GNU/Linux

Notified:  February 07, 2012 Updated:  February 07, 2012

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Gentoo Linux

Notified:  February 07, 2012 Updated:  February 07, 2012

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Mandriva S. A.

Notified:  February 07, 2012 Updated:  February 07, 2012

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Red Hat, Inc.

Notified:  February 07, 2012 Updated:  February 07, 2012

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Slackware Linux Inc.

Notified:  February 07, 2012 Updated:  February 07, 2012

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Ubuntu

Notified:  February 07, 2012 Updated:  February 07, 2012

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
Temporal 5.3 E:POC/RL:OF/RC:C
Environmental 5.3 CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Tomasz Salacinski of CERT Polska for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs: None
Severity Metric: 1.06
Date Public: 2012-03-19
Date First Published: 2012-03-19
Date Last Updated: 2012-04-09 20:08 UTC
Document Revision: 25

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.