PT-2021-4282 · Inspircd · Inspircd

Sadiecat · Published 2021-05-26 · Updated 2022-06-03 · CVE-2021-33586

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions InspIRCd versions 3.8.0 through 3.9.x

Description The issue is related to a problem where any user able to connect to the server can access recently deallocated memory, also known as the "malformed PONG" issue. This is due to incorrect permission assignment for a critical resource, which can allow a remote attacker to gain access to confidential data.

Recommendations For InspIRCd versions 3.8.0 through 3.9.x, update to version 3.10.0 or later to resolve the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2021-04890

CVE-2021-33586

Affected Products

Inspircd

References · 12

• https://github.com/inspircd/inspircd/commit/4350a11c663b0d75f8119743bffb7736d87abd4d · Patch
• https://cve.org/CVERecord?id=CVE-2021-33586 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-33586 · Vendor Advisory
• https://security.gentoo.org/glsa/202107-22 · Vendor Advisory
• https://docs.inspircd.org/security/2021-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33586 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33586 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33586 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04890 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33586 · Vendor Advisory
• https://t.me/cvenotify/15146 · Telegram Post