PT-2016-3957 · Inspircd · Inspircd

Ping86 · Published 2016-03-23 · Updated 2020-09-14 · CVE-2015-8702

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions InspIRCd versions prior to 2.0.19

Description The issue allows remote DNS servers to cause a denial of service, also known as a netsplit, by sending an invalid character in a PTR response. This can be triggered by a specific character, such as a whitespace character, in a hostname.

Recommendations For versions prior to 2.0.19, update to version 2.0.19 or later to resolve the issue. As a temporary workaround, consider restricting DNS responses to prevent invalid characters from causing a denial of service.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-8702

DLA-384-1

DSA-3527-1

Affected Products

Inspircd

References · 17

• 🔥 https://github.com/inspircd/inspircd/issues/1033 · Exploit
• 🔥 https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559 · Exploit
• http://inspircd.org/2015/04/16/v2019-released.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/inspircd · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8702 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3527-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8702 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8702 · Vendor Advisory
• https://security.gentoo.org/glsa/201512-13 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8702 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8702 · Security Note
• https://osv.dev/vulnerability/DSA-3527-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8702 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8702 · Vendor Advisory
• http://debian.org/security/2016/dsa-3527 · Vendor Advisory