PT-2020-6766 · Inspircd+3 · Inspircd+3

Sadiecat · Published 2020-04-22 · Updated 2025-04-02 · CVE-2020-25269

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions InspIRCd versions prior to 2.0.29 InspIRCd versions prior to 3.6.0

Description An issue was discovered in the pgsql module of InspIRCd, which contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this issue can be used for remote crashing of an InspIRCd server by any user able to connect to the server. The vulnerability is related to the use of memory after it has been freed, which can allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 2.0.29, update to version 2.0.29 or later. For versions prior to 3.6.0, update to version 3.6.0 or later. As a temporary workaround, consider disabling the pgsql module, as well as the sqlauth or sqloper modules, until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2020-3126

ALT-PU-2020-3171

ALT-PU-2024-11122

BDU:2022-06172

CVE-2020-25269

DLA-2375-1

DSA-4764-1

USN-7405-1

Affected Products

Alt Linux

Inspircd

Linuxmint

Ubuntu

References · 25

• https://github.com/inspircd/inspircd/compare/426d1c8...b3f1db9 · Patch
• https://github.com/inspircd/inspircd/compare/v2.0.28...07d7dea · Patch
• https://osv.dev/vulnerability/USN-7405-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25269 · Security Note
• https://bdu.fstec.ru/vul/2022-06172 · Security Note
• https://docs.inspircd.org/security/2020-01 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25269 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25269 · Security Note
• https://ubuntu.com/security/notices/USN-7405-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20917 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-25269 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25269 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25269 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2375-1 · Vendor Advisory