ignitionServer Server Link Service Authentication Bypass Vulnerability

Bugtraq ID:	10525
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 11 2004 12:00AM
Updated:	Jun 11 2004 12:00AM
Credit:	The vendor announced this vulnerability.
Vulnerable:	The Ignition Project ignitionServer 0.3.1
Not Vulnerable:	The Ignition Project ignitionServer 0.3.1 -P1

ignitionServer Server Link Service Authentication Bypass Vulnerability

ignitionServer is reported prone to an authentication bypass vulnerability. IRC servers can be linked together to form IRC networks. ignitionServer server linking functionality is not reported to be fully functional and so is not enabled by default. However, it is reported that if the ignitionServer linking service is enabled, a remote ignitionServer server may link to the vulnerable ignitionServer without requiring any authentication at all.

ignitionServer Server Link Service Authentication Bypass Vulnerability

There is no exploit required.

ignitionServer Server Link Service Authentication Bypass Vulnerability

Solution:
The vendor has released an upgrade to address this issue:


The Ignition Project ignitionServer 0.3.1

• The Ignition Project ignitionServer 0.3.1-P1
  http://www.ignition-project.com/ignition/server/download/

ignitionServer Server Link Service Authentication Bypass Vulnerability

References:

• The Ignition Project Homepage (The Ignition Project)