Multiple Vendor IRC Daemon Debug Format String

This script is Copyright (C) 2003-2011 Tenable Network Security, Inc.


Synopsis :

The remote chat server is affected by a remote command execution
vulnerability.

Description :

The remote host is running a version of ircd that could be vulnerable
to a format string attack.

An attacker could exploit this flaw to execute arbitrary code on this
host, or simply to disable this service remotely.

See also :

http://marc.info/?l=bugtraq&m=105665996104723&w=2
http://marc.info/?l=bugtraq&m=105673555726823&w=2
http://marc.info/?l=bugtraq&m=105673489525906&w=2

Solution :

Upgrade to one of the following IRC daemon :
andromede.net AndromedeIRCd 1.2.4
DALnet Bahamut IRCd 1.4.36
digatech digatech IRCd 1.2.2
methane methane IRCd 0.1.2

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.3
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: Gain a shell remotely

Nessus Plugin ID: 11783 (ircd_format_string.nasl)

Bugtraq ID: 8038

CVE ID: CVE-2003-0478