Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate.

Multiple vulnerabilities has been found and corrected in irssi :

Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate (CVE-2010-1155).

core/nicklist.c in Irssi before 0.8.15 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to an attempted fuzzy nick match at the instant that a victim leaves a channel (CVE-2010-1156).

Additionally the updated packages disables the SSLv2 protocol and enables the SSLv3 and TLSv1 protocols for added security.

The updated packages have been patched to correct these issues.

This release fixes two security issues: The first being that Irssi didn't check hostname on SSL connections and the other being a hard to exploit remote crash bug. For a complete listing of the changes and bugfixes since 0.8.14, please have a look at the http://irssi.org/news/ChangeLog

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

irssi did not check the identity information of a remote hosts's certificate. Attackers could exploit that for a man-in-the-middle attack (CVE-2010-1155).

irssi could crash if someone changed nick while the victim was leaving the channel (CVE-2010-1156).

New irssi packages are available for Slackware 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues.

USN-929-1 fixed vulnerabilities in irssi. The upstream changes introduced a regression when using irssi with SSL and an IRC proxy.
This update fixes the problem.

We apologize for the inconvenience.

It was discovered that irssi did not perform certificate host validation when using SSL connections. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2010-1155)

Aurelien Delaitre discovered that irssi could be made to dereference a NULL pointer when a user left the channel. A remote attacker could cause a denial of service via application crash. (CVE-2010-1156)

This update also adds SSLv3 and TLSv1 support, while disabling the old, insecure SSLv2 protocol.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities have found in irssi. The first issue could allow man-in-the-middle attacks due to a missing comparison of SSL server hostnames and the certificate domain names (e.g. CN).

A second vulnerability, related to the nick matching code, could be triggered by remote attackers in order to crash an irssi client when leaving a channel.

It was discovered that irssi did not perform certificate host validation when using SSL connections. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2010-1155)

Aurelien Delaitre discovered that irssi could be made to dereference a NULL pointer when a user left the channel. A remote attacker could cause a denial of service via application crash. (CVE-2010-1156)

This update also adds SSLv3 and TLSv1 support, while disabling the old, insecure SSLv2 protocol.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
48180	Mandriva Linux Security Advisory : irssi (MDVSA-2010:079)	Nessus	Mandriva Local Security Checks	medium
47443	Fedora 12 : irssi-0.8.15-1.fc12 (2010-6629)	Nessus	Fedora Local Security Checks	medium
46190	openSUSE Security Update : irssi (openSUSE-SU-2010:0183-1)	Nessus	SuSE Local Security Checks	medium
46188	openSUSE Security Update : irssi (openSUSE-SU-2010:0183-1)	Nessus	SuSE Local Security Checks	medium
46186	openSUSE Security Update : irssi (openSUSE-SU-2010:0183-1)	Nessus	SuSE Local Security Checks	medium
45611	Slackware 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / current : irssi (SSA:2010-116-01)	Nessus	Slackware Local Security Checks	medium
45589	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : irssi regression (USN-929-2)	Nessus	Ubuntu Local Security Checks	medium
45570	FreeBSD : irssi -- multiple vulnerabilities (3b7967f1-49e8-11df-83fb-0015587e2cc1)	Nessus	FreeBSD Local Security Checks	medium
45551	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : irssi vulnerabilities (USN-929-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2010-1155

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium