PT-2007-4525 · Unknown · Irc Services

Publicado 2007-06-15 · Atualizado 2017-07-29 · CVE-2007-3246

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: IRC Services versions prior to 5.0.60

Description: The issue concerns the preservation of channel founder privileges across a channel password change. This allows remote authenticated users to obtain the new password through automated e-mail or perform privileged actions without knowing the new password. The do set password function in modules/chanserv/set.c is specifically implicated.

Recommendations: For versions prior to 5.0.60, update to version 5.0.60 or later to resolve the issue. As a temporary workaround, consider disabling the do set password function until a patch is available. Restrict access to privileged actions to minimize the risk of exploitation. Avoid using the channel password change feature until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-3246

Produtos afetados

Irc Services

Referências · 6

• http://osvdb.org/41691 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34945 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3246 · Nota de Segurança
• http://lists.ircservices.za.net/pipermail/ircservices/2007/005228.html · Correção
• http://lists.ircservices.za.net/pipermail/ircservices/2007/005229.html · Nota
• http://ircservices.za.net/Changes.txt · Nota