InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access
    recently deallocated memory, aka the "malformed PONG" issue. (CVE-2021-33586)

The remote host is affected by the vulnerability described in GLSA-202107-22 (InspIRCd: Information disclosure)

    InspIRCd incorrectly handled malformed PONG messages, resulting in       access of freed memory.
  Impact :

    A remote attacker could send crafted packets to the server, possibly       allowing them to obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
426603	Alpine: multiple inspircd packages: security update to 3.10.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
426603	Alpine: multiple inspircd packages: security update to 3.10.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
400206	Alpine: inspircd: security update to 3.8.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
400206	Alpine: inspircd: security update to 3.8.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
156998	GLSA-202107-22 : InspIRCd: Information disclosure	Nessus	Gentoo Local Security Checks	Local	medium

Detections

Analytics

CVE-2021-33586

medium

Tenable Plugins

medium

medium

medium

medium

medium