Crackalaka IRC Server Remote Denial of Service Vulnerability

Bugtraq ID:	10092
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 09 2004 12:00AM
Updated:	Apr 09 2004 12:00AM
Credit:	Discovery is credited to Donato Ferrante <[email protected]>.
Vulnerable:	Crackalaka Crackalaka 1.0 .8
Not Vulnerable:

Crackalaka IRC Server Remote Denial of Service Vulnerability

It has been reported that Crackalaka may be prone to a remote denial of service vulnerability that may allow an attacker to crash the server by sending an excessive amount of data.

Crackalaka version 1.0.8 is reported to be prone to this issue, however, other versions could be vulnerable as well.

Crackalaka IRC Server Remote Denial of Service Vulnerability

The following proof of concept has been provided:
nc [host] 6667 < /dev/urandom

Crackalaka IRC Server Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Crackalaka IRC Server Remote Denial of Service Vulnerability

References:

• Crackalaka (Crackalaka)
  
• DoS in Crackalaka 1.0.8 ("Donato Ferrante" )