[ GLSA 200701-26 ] KSirc: Denial of Service vulnerability

[GLSA]

Gentoo Linux Security Advisory

Title: KSirc: Denial of Service vulnerability (GLSA 200701-26)
Severity: normal
Exploitable: remote
Date: January 29, 2007
Updated: January 30, 2007
Bug(s): #159658
ID: 200701-26

Synopsis

KSirc is vulnerable to a Denial of Service attack.

Background

KSirc is the default KDE IRC client.

Affected Packages

Package: kde-base/ksirc
Vulnerable: < 3.5.5-r1
Unaffected: >= 3.5.5-r1
Architectures: All supported architectures


Description

KSirc fails to check the size of an incoming PRIVMSG string sent from an IRC server during the connection process.

Impact

A malicious IRC server could send a long PRIVMSG string to the KSirc client causing an assertion failure and the dereferencing of a null pointer, resulting in a crash.

Workaround

There is no known workaround at this time.

Resolution

All KSirc users should upgrade to the latest version: