PT-2007-4525 · Unknown · Irc Services

Published 2007-06-15 · Updated 2017-07-29 · CVE-2007-3246

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: IRC Services versions prior to 5.0.60

Description: The issue concerns the preservation of channel founder privileges across a channel password change. This allows remote authenticated users to obtain the new password through automated e-mail or perform privileged actions without knowing the new password. The do set password function in modules/chanserv/set.c is specifically implicated.

Recommendations: For versions prior to 5.0.60, update to version 5.0.60 or later to resolve the issue. As a temporary workaround, consider disabling the do set password function until a patch is available. Restrict access to privileged actions to minimize the risk of exploitation. Avoid using the channel password change feature until the issue is resolved.

Fix

Related Identifiers

CVE-2007-3246

Affected Products

Irc Services

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-3246 · Security Note
• http://lists.ircservices.za.net/pipermail/ircservices/2007/005228.html · Patch
• http://osvdb.org/41691 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34945 · Note
• http://lists.ircservices.za.net/pipermail/ircservices/2007/005229.html · Note
• http://ircservices.za.net/Changes.txt · Note