BNC IRC Server Proxy Authentication Bypass Vulnerability

Bugtraq ID:	11650
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 10 2004 12:00AM
Updated:	Nov 10 2004 12:00AM
Credit:	The vendor disclosed this issue.
Vulnerable:	BNC BNC 2.9 .0 BNC BNC 2.8.9 BNC BNC 2.8.8 BNC BNC 2.6.2 BNC BNC 2.6 BNC BNC 2.4.8 BNC BNC 2.4.6 BNC BNC 2.2.4
Not Vulnerable:	BNC BNC 2.9.1 + Gentoo Linux

BNC IRC Server Proxy Authentication Bypass Vulnerability

BNC is reported prone to an authentication bypass vulnerability. It is reported by the vendor that only users with incorrect passwords were granted access to the resources.

It is possible that this issue surfaced due to code modifications after the recent release of BNC 2.9.0, which addresses various issues including a security vulnerability (BID 11647).

Due to a lack of details, further information is not available at the moment. This BID will be updated as more information becomes available.

BNC IRC Server Proxy Authentication Bypass Vulnerability

No exploit is required.

BNC IRC Server Proxy Authentication Bypass Vulnerability

Solution:
This issue is addressed in version 2.9.1.


BNC BNC 2.2.4

• BNC bnc2.9.1.tar.gz
  http://www.gotbnc.com/files/bnc2.9.1.tar.gz

BNC BNC 2.4.6

• BNC bnc2.9.1.tar.gz
  http://www.gotbnc.com/files/bnc2.9.1.tar.gz

BNC BNC 2.4.8

• BNC bnc2.9.1.tar.gz
  http://www.gotbnc.com/files/bnc2.9.1.tar.gz

BNC BNC 2.6

• BNC bnc2.9.1.tar.gz
  http://www.gotbnc.com/files/bnc2.9.1.tar.gz

BNC BNC 2.6.2

• BNC bnc2.9.1.tar.gz
  http://www.gotbnc.com/files/bnc2.9.1.tar.gz

BNC BNC 2.8.8

• BNC bnc2.9.1.tar.gz
  http://www.gotbnc.com/files/bnc2.9.1.tar.gz

BNC BNC 2.8.9

• BNC bnc2.9.1.tar.gz
  http://www.gotbnc.com/files/bnc2.9.1.tar.gz

BNC BNC 2.9 .0

• BNC bnc2.9.1.tar.gz
  http://www.gotbnc.com/files/bnc2.9.1.tar.gz

BNC IRC Server Proxy Authentication Bypass Vulnerability

References:

• BNC Home Page (BNC)