Out-of-Bounds Access in ngIRCd Server-Server Protocol Implementation (CVE-2020-14148)
Summary
CVE-2020-14148: The Server-Server protocol implementation in ngIRCd before 26~rc2 allows an out-of-bounds access, as demonstrated by the IRC_NJOIN() function. Affects ngircd across 2 version ranges.
< 4bcf4613f9719f70f94ef4efd290fcc35d9c51f2
< 25-r1
Fixed in 25-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ngIRCd is an open-source Internet Relay Chat (IRC) server that allows users to communicate with each other in real-time. It provides a platform for creating and managing IRC networks. The vulnerability (CVE-2020-14148) affects ngIRCd versions before 26~rc2. This vulnerability allows an attacker to perform an out-of-bounds access, specifically in the IRC_NJOIN() function.
Vulnerability Detail
The vulnerability (CVE-2020-14148) in ngIRCd's Server-Server protocol implementation arises due to an out-of-bounds access issue. An attacker can exploit this vulnerability to gain unauthorized access or execute arbitrary code on the affected system. The IRC_NJOIN() function is the specific point of weakness. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
25-r1
This is the first release that contains the fix.
sudo apk add --upgrade ngircdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround available for this vulnerability. It is essential to update to the fixed version as soon as possible to address the issue.
Conclusion
The vulnerability (CVE-2020-14148) in ngIRCd's Server-Server protocol implementation poses a significant risk to the security and integrity of the affected systems. It is crucial to update ngIRCd to version 26~rc2 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ngircd →
FAQ
ngIRCd is an open-source IRC server used for creating and managing IRC networks.
The vulnerability allows an attacker to perform out-of-bounds access, potentially leading to unauthorized access or arbitrary code execution.
The CVSS score of CVE-2020-14148 is 7.5, indicating a high severity level.
To fix the vulnerability, update ngIRCd to version 26~rc2 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for ngircd.
