Critical Vulnerability in Irssi: Memory Corruption Risk from DCC File Handling
Summary
ALPINE-CVE-2017-9469: In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Affects irssi versions < 1.0.3-r0. Fixed in 1.0.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Irssi is a popular terminal-based IRC client that allows users to connect to multiple IRC networks and channels. It is known for its extensibility through scripts and its lightweight nature, making it a preferred choice for many users. However, a vulnerability has been identified in versions prior to 1.0.3, which could lead to memory corruption when handling incorrectly quoted DCC files.
Vulnerability Detail
In Irssi before version 1.0.3, a vulnerability exists that arises when the application receives certain incorrectly quoted DCC (Direct Client-to-Client) files. The software attempts to locate the terminating quote one byte before the allocated memory, which can lead to a crash. This vulnerability can be exploited by remote attackers, potentially causing denial of service and impacting the stability of the application. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.0.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade irssiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening DCC files from untrusted sources until the package is updated. Additionally, users can disable DCC file transfers in the Irssi settings to mitigate the risk.
Conclusion
The vulnerability in Irssi poses a significant risk to users, particularly those who frequently use DCC file transfers. It is crucial to update to the latest version to ensure the security and stability of the application. Users are also encouraged to adopt safe practices when handling files from unknown sources.
See every vulnerability recorded for irssi →
FAQ
The vulnerability can lead to a crash of the Irssi client, resulting in a denial of service for users.
You can check your version of Irssi by running the command 'irssi --version' in your terminal.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, avoid opening DCC files from untrusted sources and consider disabling DCC file transfers.
More information can be found in the CVE database or by visiting the official Irssi website.
References
Related vulnerabilities
Recent vulnerabilities recorded for irssi.
