The remote host is affected by the vulnerability described in GLSA-200909-13 (irssi: Execution of arbitrary code)

    Nemo discovered an off-by-one error leading to a heap overflow in     irssi's event_wallops() parsing function.
  Impact :

    A remote attacker might entice a user to connect to a malicious IRC     server, use a man-in-the-middle attack to redirect a user to such a     server or use ircop rights to send a specially crafted WALLOPS message,     which might result in the execution of arbitrary code with the     privileges of the user running irssi.
  Workaround :

    There is no known workaround at this time.

- Tue Jun 23 2009 Huzaifa Sidhpurwala <huzaifas at     redhat.com> - 0.8.13-3

    - Resolve CVE-2009-1959

    - Fri May 1 2009 Marek Mahut <mmahut at       fedoraproject.org> - 0.8.13-1

    - Upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that irssi did not properly check the length of strings when processing WALLOPS messages. If a user connected to an IRC network where an attacker had IRC operator privileges, a remote attacker could cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixed a irssi off by one overflow in the event_wallops() function.
CVE-2009-1959 has been assigned to this issue.

A vulnerability has been found and corrected in irssi :

Off-by-one error in the event_wallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to cause a denial of service (crash) via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow (CVE-2009-1959).

This update provides fixes for this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

- Tue Jun 23 2009 Huzaifa Sidhpurwala <huzaifas at     redhat.com> - 0.8.13-3

    - Resolve CVE-2009-1959

    - Fri May 1 2009 Marek Mahut <mmahut at       fedoraproject.org> - 0.8.13-1

    - Upstream release

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 0.8.12-13

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Sat Jan 17 2009 Tomas Mraz <tmraz at redhat.com> -       0.8.12-12

    - rebuild with new openssl

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
40960	GLSA-200909-13 : irssi: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	2009/9/14	2021/1/6	medium
40474	Fedora 11 : irssi-0.8.13-3.fc11 (2009-7012)	Nessus	Fedora Local Security Checks	2009/8/4	2021/1/11	medium
39787	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : irssi vulnerability (USN-800-1)	Nessus	Ubuntu Local Security Checks	2009/7/14	2021/1/19	medium
39994	openSUSE Security Update : irssi (irssi-1004)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	medium
40234	openSUSE Security Update : irssi (irssi-1004)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	medium
39429	Mandriva Linux Security Advisory : irssi (MDVSA-2009:133-1)	Nessus	Mandriva Local Security Checks	2009/6/17	2021/1/6	medium
40828	Fedora 10 : irssi-0.8.13-3.fc10 (2009-7004)	Nessus	Fedora Local Security Checks	2009/9/2	2021/1/11	medium
39433	openSUSE 10 Security Update : irssi (irssi-6304)	Nessus	SuSE Local Security Checks	2009/6/17	2021/1/14	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium