ngIRCd: Buffer overflow — GLSA 200501-40

ngIRCd is vulnerable to a buffer overflow that can be used to crash the daemon and possibly execute arbitrary code.

Affected packages

Background

ngIRCd is a free open source daemon for Internet Relay Chat (IRC).

Description

Florian Westphal discovered a buffer overflow caused by an integer underflow in the Lists_MakeMask() function of lists.c.

Impact

A remote attacker can exploit this buffer overflow to crash the ngIRCd daemon and possibly execute arbitrary code with the rights of the ngIRCd daemon process.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-irc/ngIRCd-0.8.2"

References

• ngIRCd Release Annoucement
• CVE-2005-0199

Release date
January 28, 2005

Latest revision
May 22, 2006: 02

Severity
high

Exploitable
remote

Bugzilla entries

• 79705