PT-2004-3444 · Ignition · Ignitionserver

Keith Gable · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2553

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions The Ignition Project ignitionServer versions 0.1.2 through 0.1.2-R2

Description The issue allows remote authenticated users with local IRC operator privileges to obtain global IRC operator privileges. This is achieved by using the unofficial umode command with the +ORD argument.

Recommendations For versions 0.1.2 through 0.1.2-R2, consider restricting access to the umode command or removing the +ORD argument functionality to prevent exploitation until a patch is available.

Fix

Related Identifiers

CVE-2004-2553

Affected Products

Ignitionserver

References · 8

• http://securitytracker.com/id?1009301 · Patch
• http://securityfocus.com/bid/9783 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2553 · Security Note
• http://secunia.com/advisories/11017 · Patch
• http://sourceforge.net/tracker/index.php?func=detail&aid=891555&group_id=96071&atid=613526 · Note
• http://cvs.sourceforge.net/viewcvs.py/ignition/ignitionserver/docs/security/20040302-operator-privilege-escalation.txt?view=markup · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15363 · Note
• http://osvdb.org/4121 · Note