An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could     incorrectly use the GHashTable interface and free the nick while updating it. This would then result in     use-after-free conditions on each access of the hash table. (CVE-2017-10966)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi
    would try to dereference a NULL pointer. (CVE-2017-10965)

  - An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could
    incorrectly use the GHashTable interface and free the nick while updating it. This would then result in
    use-after-free conditions on each access of the hash table. (CVE-2017-10966)

According to the versions of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Irssi before 1.0.4. When     receiving messages with invalid time stamps, Irssi     would try to dereference a NULL     pointer.(CVE-2017-10965)

  - An issue was discovered in Irssi before 1.0.4. While     updating the internal nick list, Irssi could     incorrectly use the GHashTable interface and free the     nick while updating it. This would then result in     use-after-free conditions on each access of the hash     table.(CVE-2017-10966)

  - In Irssi before 1.0.3, when receiving a DCC message     without source nick/host, it attempts to dereference a     NULL pointer. Thus, remote IRC servers can cause a     crash.(CVE-2017-9468)

  - In Irssi before 1.0.3, when receiving certain     incorrectly quoted DCC files, it tries to find the     terminating quote one byte before the allocated memory.
    Thus, remote attackers might be able to cause a     crash.(CVE-2017-9469)

  - In Irssi before 1.0.6, a calculation error in the     completion code could cause a heap buffer overflow when     completing certain strings.(CVE-2018-5208)

  - Irssi before 0.8.21 allows remote attackers to cause a     denial of service (out-of-bounds read and crash) via a     string containing a formatting sequence (%[) without a     closing bracket (]).(CVE-2017-5356)

  - The nickcmp function in Irssi before 0.8.21 allows     remote attackers to cause a denial of service (NULL     pointer dereference and crash) via a message without a     nick.(CVE-2017-5193)

  - Use-after-free vulnerability in Irssi before 0.8.21     allows remote attackers to cause a denial of service     (crash) via an invalid nick message.(CVE-2017-5194)

  - When the channel topic is set without specifying a     sender, Irssi before 1.0.6 may dereference a NULL     pointer.(CVE-2018-5206)

  - When using an incomplete variable argument, Irssi     before 1.0.6 may access data beyond the end of the     string.(CVE-2018-5207)

  - When using incomplete escape codes, Irssi before 1.0.6     may access data beyond the end of the     string.(CVE-2018-5205)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Irssi before 1.0.6, a calculation error in the     completion code could cause a heap buffer overflow when     completing certain strings.(CVE-2018-5208)

  - When using incomplete escape codes, Irssi before 1.0.6     may access data beyond the end of the     string.(CVE-2018-5205)

  - When the channel topic is set without specifying a     sender, Irssi before 1.0.6 may dereference a NULL     pointer.(CVE-2018-5206)

  - When using an incomplete variable argument, Irssi     before 1.0.6 may access data beyond the end of the     string.(CVE-2018-5207)

  - The nickcmp function in Irssi before 0.8.21 allows     remote attackers to cause a denial of service (NULL     pointer dereference and crash) via a message without a     nick.(CVE-2017-5193)

  - Use-after-free vulnerability in Irssi before 0.8.21     allows remote attackers to cause a denial of service     (crash) via an invalid nick message.(CVE-2017-5194)

  - Irssi before 0.8.21 allows remote attackers to cause a     denial of service (out-of-bounds read and crash) via a     string containing a formatting sequence (%[) without a     closing bracket (]).(CVE-2017-5356)

  - In Irssi before 1.0.3, when receiving a DCC message     without source nick/host, it attempts to dereference a     NULL pointer. Thus, remote IRC servers can cause a     crash.(CVE-2017-9468)

  - In Irssi before 1.0.3, when receiving certain     incorrectly quoted DCC files, it tries to find the     terminating quote one byte before the allocated memory.
    Thus, remote attackers might be able to cause a     crash.(CVE-2017-9469)

  - An issue was discovered in Irssi before 1.0.4. When     receiving messages with invalid time stamps, Irssi     would try to dereference a NULL     pointer.(CVE-2017-10965)

  - An issue was discovered in Irssi before 1.0.4. While     updating the internal nick list, Irssi could     incorrectly use the GHashTable interface and free the     nick while updating it. This would then result in     use-after-free conditions on each access of the hash     table.(CVE-2017-10966)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The nickcmp function in Irssi before 0.8.21 allows     remote attackers to cause a denial of service (NULL     pointer dereference and crash) via a message without a     nick.(CVE-2017-5193)

  - Use-after-free vulnerability in Irssi before 0.8.21     allows remote attackers to cause a denial of service     (crash) via an invalid nick message.(CVE-2017-5194)

  - Irssi before 0.8.21 allows remote attackers to cause a     denial of service (out-of-bounds read and crash) via a     string containing a formatting sequence (%[) without a     closing bracket (]).(CVE-2017-5356)

  - In Irssi before 1.0.3, when receiving a DCC message     without source nick/host, it attempts to dereference a     NULL pointer. Thus, remote IRC servers can cause a     crash.(CVE-2017-9468)

  - In Irssi before 1.0.3, when receiving certain     incorrectly quoted DCC files, it tries to find the     terminating quote one byte before the allocated memory.
    Thus, remote attackers might be able to cause a     crash.(CVE-2017-9469)

  - An issue was discovered in Irssi before 1.0.4. When     receiving messages with invalid time stamps, Irssi     would try to dereference a NULL     pointer.(CVE-2017-10965)

  - An issue was discovered in Irssi before 1.0.4. While     updating the internal nick list, Irssi could     incorrectly use the GHashTable interface and free the     nick while updating it. This would then result in     use-after-free conditions on each access of the hash     table.(CVE-2017-10966)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in Irssi, a terminal based IRC client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-10965     Brian 'geeknik' Carpenter of Geeknik Labs discovered     that Irssi does not properly handle receiving messages     with invalid time stamps. A malicious IRC server can     take advantage of this flaw to cause Irssi to crash,     resulting in a denial of service.

  - CVE-2017-10966     Brian 'geeknik' Carpenter of Geeknik Labs discovered     that Irssi is susceptible to a use-after-free flaw     triggered while updating the internal nick list. A     malicious IRC server can take advantage of this flaw to     cause Irssi to crash, resulting in a denial of service.

  - CVE-2017-15227     Joseph Bisch discovered that while waiting for the     channel synchronisation, Irssi may incorrectly fail to     remove destroyed channels from the query list, resulting     in use after free conditions when updating the state     later on. A malicious IRC server can take advantage of     this flaw to cause Irssi to crash, resulting in a denial     of service.

  - CVE-2017-15228     Hanno Boeck reported that Irssi does not properly handle     installing themes with unterminated colour formatting     sequences, leading to a denial of service if a user is     tricked into installing a specially crafted theme.

  - CVE-2017-15721     Joseph Bisch discovered that Irssi does not properly     handle incorrectly formatted DCC CTCP messages. A remote     attacker can take advantage of this flaw to cause Irssi     to crash, resulting in a denial of service.

  - CVE-2017-15722     Joseph Bisch discovered that Irssi does not properly     verify Safe channel IDs. A malicious IRC server can take     advantage of this flaw to cause Irssi to crash,     resulting in a denial of service.

  - CVE-2017-15723     Joseph Bisch reported that Irssi does not properly     handle overlong nicks or targets resulting in a NULL     pointer dereference when splitting the message and     leading to a denial of service.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3465-1 advisory.

    Brian Carpenter discovered that Irssi incorrectly handled messages with invalid time stamps. A malicious     IRC server could use this issue to cause Irssi to crash, resulting in a denial of service.
    (CVE-2017-10965)

    Brian Carpenter discovered that Irssi incorrectly handled the internal nick list. A malicious IRC server     could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-10966)

    Joseph Bisch discovered that Irssi incorrectly removed destroyed channels from the query list. A malicious     IRC server could use this issue to cause Irssi to crash, resulting in a denial of service.
    (CVE-2017-15227)

    Hanno Bck discovered that Irssi incorrectly handled themes. If a user were tricked into using a     malicious theme, a attacker could use this issue to cause Irssi to crash, resulting in a denial of     service. (CVE-2017-15228)

    Joseph Bisch discovered that Irssi incorrectly handled certain DCC CTCP messages. A malicious IRC server     could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-15721)

    Joseph Bisch discovered that Irssi incorrectly handled certain channel IDs. A malicious IRC server could     use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-15722)

    Joseph Bisch discovered that Irssi incorrectly handled certain long nicks or targets. A malicious IRC     server could use this issue to cause Irssi to crash, resulting in a denial of service. (CVE-2017-15723)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Some Irssi issues were found :

CVE-2017-10965

  An issue was discovered in Irssi before 1.0.4. When receiving messages with   invalid time stamps, Irssi would try to dereference a NULL pointer.

CVE-2017-10966

  An issue was discovered in Irssi before 1.0.4. While updating the internal   nick list, Irssi could incorrectly use the GHashTable interface and free   the nick while updating it. This would then result in use-after-free   conditions on each access of the hash table.

For Debian 7 'Wheezy', these problems have been fixed in version 0.8.15-5+deb7u3.

We recommend that you upgrade your irssi packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update fixing CVE-2017-10965 and CVE-2017-10966.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for irssi to version fixes the following issues :

  - CVE-2017-10965: A malicious server could cause irssi to     crash by providing an invalid timestamp

  - CVE-2017-10966: Undefined behavior may be triggered when     irssi updates the internal nick list

A number of minor upstream bug fixes are also included.

irssi reports :

When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.

While updating the internal nick list, Irssi may incorrectly use the GHashTable interface and free the nick while updating it. This will then result in use-after-free conditions on each access of the hash table.

New irssi packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

ID	Name	Product	Family	Severity
220427	Linux Distros Unpatched Vulnerability : CVE-2017-10966	Nessus	Misc.	critical
405012	Alpine: irssi-proxy: security update to 1.0.4.-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405012	Alpine: irssi-proxy: security update to 1.0.4.-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405011	Alpine: multiple irssi packages: security update to 1.0.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405011	Alpine: multiple irssi packages: security update to 1.0.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405009	Alpine: multiple irssi packages: security update to 0.8.21.r2	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405009	Alpine: multiple irssi packages: security update to 0.8.21.r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400859	Alpine: multiple irssi packages: security update to 1.0.3-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400859	Alpine: multiple irssi packages: security update to 1.0.3-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
132130	EulerOS 2.0 SP3 : irssi (EulerOS-SA-2019-2595)	Nessus	Huawei Local Security Checks	critical
131630	EulerOS 2.0 SP2 : irssi (EulerOS-SA-2019-2477)	Nessus	Huawei Local Security Checks	critical
129128	EulerOS 2.0 SP5 : irssi (EulerOS-SA-2019-1971)	Nessus	Huawei Local Security Checks	critical
104400	Debian DSA-4016-1 : irssi - security update	Nessus	Debian Local Security Checks	critical
104212	Ubuntu 14.04 LTS / 16.04 LTS : Irssi vulnerabilities (USN-3465-1)	Nessus	Ubuntu Local Security Checks	critical
102962	Debian DLA-1089-1 : irssi security update	Nessus	Debian Local Security Checks	critical
102396	Fedora 25 : irssi (2017-90ad72e684)	Nessus	Fedora Local Security Checks	critical
101825	Fedora 26 : irssi (2017-114e1abf9d)	Nessus	Fedora Local Security Checks	critical
101347	openSUSE Security Update : irssi (openSUSE-2017-797)	Nessus	SuSE Local Security Checks	critical
101330	FreeBSD : irssi -- multiple vulnerabilities (31001c6b-63e7-11e7-85aa-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	critical
101317	Slackware 14.0 / 14.1 / 14.2 / current : irssi (SSA:2017-190-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2017-10966

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical