InspIRCd up to 2.0.27/3.2.x MySQL null pointer dereference

Summaryinfo

A vulnerability, which was classified as problematic, was found in InspIRCd up to 2.0.27/3.2.x. Affected by this vulnerability is an unknown functionality of the component MySQL Module. Executing a manipulation can lead to null pointer dereference. This vulnerability appears as CVE-2019-20917. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in InspIRCd up to 2.0.27/3.2.x. This vulnerability affects some unknown functionality of the component MySQL Module. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:

An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.

The weakness was presented 09/11/2020. This vulnerability was named CVE-2019-20917 since 09/11/2020. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 233771 (Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : InspIRCd vulnerabilities (USN-7405-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.0.28 or 3.3.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (233771). See VDB-161129 for similar entry. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• InspIRCd

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18
• 2.0.19
• 2.0.20
• 2.0.21
• 2.0.22
• 2.0.23
• 2.0.24
• 2.0.25
• 2.0.26
• 2.0.27
• 3.0
• 3.1
• 3.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion