Stack-based buffer overflow in mod/server.mod/servrmsg.c in Eggdrop 1.6.18, and possibly earlier, allows user-assisted, remote IRC servers to execute arbitrary code via a long private message.

Several vulnerabilities have been discovered in eggdrop, an advanced IRC robot. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2807     It was discovered that eggdrop is vulnerable to a buffer     overflow, which could result in a remote user executing     arbitrary code. The previous DSA (DSA-1448-1) did not     fix the issue correctly.

  - CVE-2009-1789     It was discovered that eggdrop is vulnerable to a denial     of service attack, that allows remote attackers to cause     a crash via a crafted PRIVMSG.

It was discovered that eggdrop, an advanced IRC robot, was vulnerable to a buffer overflow which could result in a remote user executing arbitrary code.

Added a patch to fix some stack based overflows (CVE-2007-2807)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200709-07 (Eggdrop: Buffer overflow)

    Bow Sineath discovered a boundary error in the file     mod/server.mod/servrmsg.c when processing overly long private messages     sent by an IRC server.
  Impact :

    A remote attacker could entice an Eggdrop user to connect the bot to a     malicious server, possibly resulting in the execution of arbitrary code     on the host running Eggdrop.
  Workaround :

    There is no known workaround at this time.

A stack-based buffer overflow in mod/server.mod/servrmsg.c in Eggdrop 1.6.18, and possibly earlier, allows user-assisted, malicious remote IRC servers to execute arbitrary code via a long private message.

Updated packages fix this issue.

ID	Name	Product	Family	Severity
44691	Debian DSA-1826-1 : eggdrop - several vulnerabilities	Nessus	Debian Local Security Checks	medium
29857	Debian DSA-1448-1 : eggdrop - buffer overflow	Nessus	Debian Local Security Checks	medium
29283	Fedora 7 : eggdrop-1.6.18-12.fc7 (2007-4325)	Nessus	Fedora Local Security Checks	medium
29282	Fedora 8 : eggdrop-1.6.18-12.fc8 (2007-4305)	Nessus	Fedora Local Security Checks	medium
26097	GLSA-200709-07 : Eggdrop: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
26007	Mandrake Linux Security Advisory : eggdrop (MDKSA-2007:175)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2007-2807

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium