OSVDB ID: 7242 Title: Multiple IRC Client Non-registered User parse_client_queued Saturation DoS |
Info |
|
|
Dates |
||||
|
|
Description |
IRCD-Hybrid and ircd-ratbox contain a flaw that may allow a remote denial of service. The issue is due to no rate limit imposed in the "parse_client_queued" function when an unidentified client sends lines. By establishing an unregistered connection and sending multiple newlines, a remote attacker can exhaust large amounts of memory resources and will result in loss of availability for the platform. |
Classification |
Location:
Remote / Network Access
Attack Type: Denial of Service, Input Manipulation Impact: Loss of Availability Exploit: Exploit Public Disclosure: OSVDB Verified |
Solution |
Upgrade to ircd-ratbox versions 1.5.2 and 2.0rc7 or IRCD-Hybrid 7.0.2 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|