Memory Access Vulnerability in InspIRCd Package - CVE-2021-33586
Summary
CVE-2021-33586: InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue. Affects inspircd across 2 version ranges.
< 3.8.1-2
< 4350a11c663b0d75f8119743bffb7736d87abd4d
Fixed in 3.8.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
InspIRCd is a modular Internet Relay Chat (IRC) server that allows users to communicate in real-time over the internet. It is designed to be lightweight and flexible, supporting various modules for enhanced functionality. The package is widely used in the IRC community for its performance and customization options. However, versions 3.8.0 through 3.9.x before 3.10.0 are susceptible to a vulnerability that allows unauthorized access to recently deallocated memory, posing a risk to server integrity and user data.
Vulnerability Detail
The vulnerability, identified as CVE-2021-33586, arises from a flaw in the handling of PONG messages within the InspIRCd server. Specifically, any user who can connect to the server can exploit this flaw to access memory that has already been deallocated. This can lead to potential information leakage, where sensitive data may be exposed, or even cause server instability. The issue is categorized with a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.8.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade inspircdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the IRC server by implementing stricter firewall rules or limiting user connections until the upgrade is completed. This can be done by configuring the server's firewall settings to block unauthorized IP addresses.
Conclusion
CVE-2021-33586 represents a significant vulnerability in the InspIRCd package, allowing unauthorized access to deallocated memory. Users are strongly advised to upgrade to version 3.10.0 or later to mitigate this risk. For those unable to upgrade immediately, implementing temporary workarounds can help protect the server until a permanent fix is applied.
See every vulnerability recorded for inspircd →
FAQ
CVE-2021-33586 is a vulnerability in the InspIRCd package that allows users to access recently deallocated memory, potentially leading to information leakage.
InspIRCd versions 3.8.0 through 3.9.x before 3.10.0 are affected by this vulnerability.
The risks include unauthorized access to sensitive information and potential instability of the IRC server.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate upgrading is not possible, consider implementing stricter access controls and monitoring server logs for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for inspircd.
