Vulnerability Name:

CVE-2009-4016 (CCN-55943)

Assigned:2009-11-19
Published:2010-01-28
Updated:2010-02-05
Summary:Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-189
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2009-4016

Source: MLIST
Type: UNKNOWN
[ircd-ratbox] 20100125 ircd-ratbox-2.2.9 released

Source: CCN
Type: SA38210
ircd-ratbox Integer Underflow and NULL Pointer Dereference Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
38210

Source: CCN
Type: SA38381
IRCD-hybrid "LINKS" Command Integer Underflow Vulnerability

Source: SECUNIA
Type: Vendor Advisory
38381

Source: CCN
Type: SA38382
oftc-hybrid "LINKS" Command Integer Underflow Vulnerability

Source: SECUNIA
Type: Vendor Advisory
38382

Source: SECUNIA
Type: Vendor Advisory
38383

Source: CONFIRM
Type: Patch
http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid_7.2.2.dfsg.2-4+lenny1.diff.gz

Source: CONFIRM
Type: UNKNOWN
http://svn.ircd-hybrid.org:8000/viewcvs.cgi?rev=1044&view=rev

Source: CONFIRM
Type: UNKNOWN
http://trac.oftc.net/projects/oftc-hybrid/browser/tags/oftc-hybrid-1.6.8/RELNOTES

Source: DEBIAN
Type: Patch
DSA-1980

Source: DEBIAN
Type: DSA-1980
ircd-hybrid/ircd-ratbox -- integer underflow/denial of service

Source: CCN
Type: IRCD-Hybrid Web Page
IRCD-Hybrid Project

Source: CCN
Type: ircdratbox Web site
ircd-ratbox

Source: CCN
Type: OFTC Web site
oftc-hybrid

Source: CCN
Type: OSVDB ID: 62151
IRCD-hybrid irc_string.c clean_string Function LINKS Command Remote Underflow

Source: CCN
Type: OSVDB ID: 62152
ircd-ratbox irc_string.c clean_string Function LINKS Command Remote Underflow

Source: CCN
Type: OSVDB ID: 62153
oftc-hybrid irc_string.c clean_string Function LINKS Command Remote Underflow

Source: BID
Type: UNKNOWN
37978

Source: CCN
Type: BID-37978
IRCD-Hybrid and ircd-ratbox 'LINKS' Command Remote Integer Underflow Vulnerability

Source: XF
Type: UNKNOWN
ircdhybrid-links-code-execution(55943)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ircd-hybrid:ircd-hybrid:7.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-hybrid:ircd-hybrid:7.2.3:*:*:*:*:*:*:*

  • Configuration 2:
  • cpe:/a:ircd-ratbox:ircd-ratbox:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.4:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.4:rc1:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.4:rc2:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:1.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.7:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:*:*:*:*:*:*:*:* (Version <= 2.2.8)

  • Configuration 3:
  • cpe:/a:oftc:oftc-hybrid:1.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.6.5:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:1.6.6:*:*:*:*:*:*:*
  • OR cpe:/a:oftc:oftc-hybrid:*:*:*:*:*:*:*:* (Version <= 1.6.7)

  • Configuration CCN 1:
  • cpe:/a:ircd-hybrid:ircd-hybrid:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.0_rc6:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-ratbox:ircd-ratbox:2.2.8:*:*:*:*:*:*:*
  • OR cpe:/a:ircd-hybrid:ircd-hybrid:7.2.2:*:*:*:*:*:*:*
  • AND
  • cpe:/o:debian:debian_linux:5.0:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:7105
    P
    DSA-1980 ircd-hybrid/ircd-ratbox -- integer underflow/denial of service
    2014-06-23
    oval:org.mitre.oval:def:13188
    P
    DSA-1980-1 ircd-hybrid/ircd-ratbox -- integer underflow/denial of service
    2014-06-23
    oval:com.ubuntu.artful:def:20094016000
    V
    CVE-2009-4016 on Ubuntu 17.10 (artful) - medium.
    2010-02-04
    oval:com.ubuntu.xenial:def:200940160000000
    V
    CVE-2009-4016 on Ubuntu 16.04 LTS (xenial) - medium.
    2010-02-04
    oval:com.ubuntu.trusty:def:20094016000
    V
    CVE-2009-4016 on Ubuntu 14.04 LTS (trusty) - medium.
    2010-02-04
    oval:com.ubuntu.bionic:def:20094016000
    V
    CVE-2009-4016 on Ubuntu 18.04 LTS (bionic) - medium.
    2010-02-04
    oval:com.ubuntu.xenial:def:20094016000
    V
    CVE-2009-4016 on Ubuntu 16.04 LTS (xenial) - medium.
    2010-02-04
    oval:com.ubuntu.cosmic:def:200940160000000
    V
    CVE-2009-4016 on Ubuntu 18.10 (cosmic) - medium.
    2010-02-04
    oval:com.ubuntu.cosmic:def:20094016000
    V
    CVE-2009-4016 on Ubuntu 18.10 (cosmic) - medium.
    2010-02-04
    oval:com.ubuntu.bionic:def:200940160000000
    V
    CVE-2009-4016 on Ubuntu 18.04 LTS (bionic) - medium.
    2010-02-04
    oval:com.ubuntu.precise:def:20094016000
    V
    CVE-2009-4016 on Ubuntu 12.04 LTS (precise) - medium.
    2010-02-04
    oval:org.debian:def:1980
    V
    integer underflow/denial of service
    2010-01-27
    BACK
    ircd-hybrid ircd-hybrid 7.2.2
    ircd-hybrid ircd-hybrid 7.2.3
    ircd-ratbox ircd-ratbox 1.0
    ircd-ratbox ircd-ratbox 1.1
    ircd-ratbox ircd-ratbox 1.1.1
    ircd-ratbox ircd-ratbox 1.1.2
    ircd-ratbox ircd-ratbox 1.2.1
    ircd-ratbox ircd-ratbox 1.2.2
    ircd-ratbox ircd-ratbox 1.2.3
    ircd-ratbox ircd-ratbox 1.3
    ircd-ratbox ircd-ratbox 1.3.1
    ircd-ratbox ircd-ratbox 1.3.2
    ircd-ratbox ircd-ratbox 1.4
    ircd-ratbox ircd-ratbox 1.4 rc1
    ircd-ratbox ircd-ratbox 1.4 rc2
    ircd-ratbox ircd-ratbox 1.4.1
    ircd-ratbox ircd-ratbox 1.4.2
    ircd-ratbox ircd-ratbox 1.5
    ircd-ratbox ircd-ratbox 1.5.1
    ircd-ratbox ircd-ratbox 1.5.2
    ircd-ratbox ircd-ratbox 1.5.3
    ircd-ratbox ircd-ratbox 2.0.0
    ircd-ratbox ircd-ratbox 2.0.1
    ircd-ratbox ircd-ratbox 2.0.2
    ircd-ratbox ircd-ratbox 2.0.3
    ircd-ratbox ircd-ratbox 2.0.4
    ircd-ratbox ircd-ratbox 2.0.5
    ircd-ratbox ircd-ratbox 2.0.6
    ircd-ratbox ircd-ratbox 2.0.7
    ircd-ratbox ircd-ratbox 2.0.8
    ircd-ratbox ircd-ratbox 2.0.9
    ircd-ratbox ircd-ratbox 2.0.10
    ircd-ratbox ircd-ratbox 2.0.11
    ircd-ratbox ircd-ratbox 2.1.0
    ircd-ratbox ircd-ratbox 2.1.0 beta1
    ircd-ratbox ircd-ratbox 2.1.0 beta2
    ircd-ratbox ircd-ratbox 2.1.1
    ircd-ratbox ircd-ratbox 2.1.2
    ircd-ratbox ircd-ratbox 2.1.3
    ircd-ratbox ircd-ratbox 2.1.4
    ircd-ratbox ircd-ratbox 2.1.5
    ircd-ratbox ircd-ratbox 2.1.6
    ircd-ratbox ircd-ratbox 2.1.7
    ircd-ratbox ircd-ratbox 2.1.8
    ircd-ratbox ircd-ratbox 2.2.0
    ircd-ratbox ircd-ratbox 2.2.0 rc1
    ircd-ratbox ircd-ratbox 2.2.0 rc2
    ircd-ratbox ircd-ratbox 2.2.0 rc3
    ircd-ratbox ircd-ratbox 2.2.1
    ircd-ratbox ircd-ratbox 2.2.2
    ircd-ratbox ircd-ratbox 2.2.3
    ircd-ratbox ircd-ratbox 2.2.4
    ircd-ratbox ircd-ratbox 2.2.5
    ircd-ratbox ircd-ratbox 2.2.6
    ircd-ratbox ircd-ratbox 2.2.7
    ircd-ratbox ircd-ratbox *
    oftc oftc-hybrid 1.4.0
    oftc oftc-hybrid 1.4.1
    oftc oftc-hybrid 1.5.0
    oftc oftc-hybrid 1.5.1
    oftc oftc-hybrid 1.5.2
    oftc oftc-hybrid 1.5.3
    oftc oftc-hybrid 1.5.4
    oftc oftc-hybrid 1.5.5
    oftc oftc-hybrid 1.5.6
    oftc oftc-hybrid 1.5.7
    oftc oftc-hybrid 1.6.0
    oftc oftc-hybrid 1.6.1
    oftc oftc-hybrid 1.6.2
    oftc oftc-hybrid 1.6.3
    oftc oftc-hybrid 1.6.4
    oftc oftc-hybrid 1.6.5
    oftc oftc-hybrid 1.6.6
    oftc oftc-hybrid *
    ircd-hybrid ircd-hybrid 7.0.1
    ircd-ratbox ircd-ratbox 2.0_rc6
    ircd-ratbox ircd-ratbox 2.2.5
    ircd-ratbox ircd-ratbox 2.2.6
    ircd-ratbox ircd-ratbox 2.2.8
    ircd-hybrid ircd-hybrid 7.2.2
    debian debian linux 5.0