IRCD-Hybrid and ircd-ratbox 'LINKS' Command Remote Integer Underflow Vulnerability

Bugtraq ID:	37978
Class:	Boundary Condition Error
CVE:	CVE-2009-4016
Remote:	Yes
Local:	No
Published:	Jan 27 2010 12:00AM
Updated:	Apr 13 2015 09:34PM
Credit:	David Leadbeater
Vulnerable:	offeryn oftc-hybrid 1.6.7 ircd-ratbox ircd-ratbox 2.2.8 ircd-ratbox ircd-ratbox 2.2.6 ircd-ratbox ircd-ratbox 2.2.5 ircd-ratbox ircd-ratbox 2.0 rc7 ircd-ratbox ircd-ratbox 2.0 rc6 IRCD-Hybrid Ircd-Hybrid 7.2.2 IRCD-Hybrid Ircd-Hybrid 7.1 devel IRCD-Hybrid Ircd-Hybrid 7.0.1 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	offeryn oftc-hybrid 1.6.8

IRCD-Hybrid and ircd-ratbox 'LINKS' Command Remote Integer Underflow Vulnerability

IRCD-Hybrid and ircd-ratbox are prone to a remote integer-underflow vulnerability.

A remote attacker may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely crash the application, denying service to legitimate users.

IRCD-Hybrid 7.2.2 and ircd-ratbox 2.2.8 are vulnerable; other versions may also be affected.

IRCD-Hybrid and ircd-ratbox 'LINKS' Command Remote Integer Underflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IRCD-Hybrid and ircd-ratbox 'LINKS' Command Remote Integer Underflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 hppa

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_hppa.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_hppa.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_hppa.deb

Debian Linux 5.0 ia-64

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_ia64.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_ia64.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_ia64.deb

Debian Linux 5.0 m68k

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb

Debian Linux 5.0 arm

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_arm.deb

Debian Linux 5.0 armel

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_armel.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_armel.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_armel.deb

Debian Linux 5.0

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb

Debian Linux 5.0 alpha

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_alpha.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_alpha.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_alpha.deb

Debian Linux 5.0 amd64

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_amd64.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_amd64.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_amd64.deb

Debian Linux 5.0 ia-32

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_i386.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_i386.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_i386.deb

Debian Linux 5.0 mips

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_mips.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_mips.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_mips.deb

Debian Linux 5.0 s/390

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_s390.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_s390.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_s390.deb

Debian Linux 5.0 mipsel

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_mipsel.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_mipsel.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_mipsel.deb

Debian Linux 5.0 powerpc

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_powerpc.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_powerpc.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_powerpc.deb

Debian Linux 5.0 sparc

• Debian hybrid-dev_7.2.2.dfsg.2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/hybrid-dev_ 7.2.2.dfsg.2-4+lenny1_all.deb


• Debian ircd-hybrid_7.2.2.dfsg.2-4+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid _7.2.2.dfsg.2-4+lenny1_sparc.deb


• Debian ircd-ratbox-dbg_2.2.8.dfsg-2+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox -dbg_2.2.8.dfsg-2+lenny1_sparc.deb


• Debian ircd-ratbox_2.2.8.dfsg-2+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/i/ircd-ratbox/ircd-ratbox _2.2.8.dfsg-2+lenny1_sparc.deb

IRCD-Hybrid and ircd-ratbox 'LINKS' Command Remote Integer Underflow Vulnerability

References:

• IRCD-Hybrid Homepage (IRCD-Hybrid)
  
• ircd-ratbox Homepage (ircd-ratbox)
  
• oftc-hybrid-1.6.8 RELNOTES (offeryn)