CVE-2009-1789 : mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allo

mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PRIVMSG that causes an empty string to trigger a negative string length copy. NOTE: this issue exists because of an incorrect fix for CVE-2007-2807.

Published 2009-05-26 16:30:03

Updated 2017-09-29 01:34:34

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2009-1789

Eggheads » Eggdrop Irc Bot
Versions up to, including, (<=) 1.6.19
cpe:2.3:a:eggheads:eggdrop_irc_bot:*:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.15
cpe:2.3:a:eggheads:eggdrop:1.6.15:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.16
cpe:2.3:a:eggheads:eggdrop:1.6.16:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.17
cpe:2.3:a:eggheads:eggdrop:1.6.17:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.11
cpe:2.3:a:eggheads:eggdrop:1.6.11:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.10
cpe:2.3:a:eggheads:eggdrop:1.6.10:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.3
cpe:2.3:a:eggheads:eggdrop:1.6.3:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.2
cpe:2.3:a:eggheads:eggdrop:1.6.2:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.18 Update RC1
cpe:2.3:a:eggheads:eggdrop:1.6.18:rc1:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.9
cpe:2.3:a:eggheads:eggdrop:1.6.9:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.8
cpe:2.3:a:eggheads:eggdrop:1.6.8:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.1
cpe:2.3:a:eggheads:eggdrop:1.6.1:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.0
cpe:2.3:a:eggheads:eggdrop:1.6.0:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.13
cpe:2.3:a:eggheads:eggdrop:1.6.13:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.12
cpe:2.3:a:eggheads:eggdrop:1.6.12:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.5
cpe:2.3:a:eggheads:eggdrop:1.6.5:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.4
cpe:2.3:a:eggheads:eggdrop:1.6.4:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.18
cpe:2.3:a:eggheads:eggdrop:1.6.18:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.14
cpe:2.3:a:eggheads:eggdrop:1.6.14:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.7
cpe:2.3:a:eggheads:eggdrop:1.6.7:*:*:*:*:*:*:*
Matching versions
Eggheads » Eggdrop » Version: 1.6.6
cpe:2.3:a:eggheads:eggdrop:1.6.6:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop
Versions up to, including, (<=) 1.6.19
cpe:2.3:a:philip_moore:windrop:*:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.10
cpe:2.3:a:philip_moore:windrop:1.6.10:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.9
cpe:2.3:a:philip_moore:windrop:1.6.9:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.1
cpe:2.3:a:philip_moore:windrop:1.6.1:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.0 Final Edition
cpe:2.3:a:philip_moore:windrop:1.6.0:*:final:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.2+bindsfix
cpe:2.3:a:philip_moore:windrop:1.6.2\+bindsfix:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.19+ctcpfix
cpe:2.3:a:philip_moore:windrop:1.6.19\+ctcpfix:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.17
cpe:2.3:a:philip_moore:windrop:1.6.17:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.16
cpe:2.3:a:philip_moore:windrop:1.6.16:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.15
cpe:2.3:a:philip_moore:windrop:1.6.15:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.6
cpe:2.3:a:philip_moore:windrop:1.6.6:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.4 Update SR1
cpe:2.3:a:philip_moore:windrop:1.6.4:sr1:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.5.4a
cpe:2.3:a:philip_moore:windrop:1.5.4a:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.5.4 Final Edition
cpe:2.3:a:philip_moore:windrop:1.5.4:*:final:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.18
cpe:2.3:a:philip_moore:windrop:1.6.18:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.8
cpe:2.3:a:philip_moore:windrop:1.6.8:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.7
cpe:2.3:a:philip_moore:windrop:1.6.7:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.0 Update Rc1-rel2
cpe:2.3:a:philip_moore:windrop:1.6.0:rc1-rel2:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.0 Update RC1
cpe:2.3:a:philip_moore:windrop:1.6.0:rc1:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.4.4 Final Edition
cpe:2.3:a:philip_moore:windrop:1.4.4:*:final:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.12
cpe:2.3:a:philip_moore:windrop:1.6.12:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.13
cpe:2.3:a:philip_moore:windrop:1.6.13:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.4.6
cpe:2.3:a:philip_moore:windrop:1.4.6:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.6.3
cpe:2.3:a:philip_moore:windrop:1.6.3:*:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.5.4 Update RC1
cpe:2.3:a:philip_moore:windrop:1.5.4:rc1:*:*:*:*:*:*
Matching versions
Philip Moore » Windrop » Version: 1.5.4 Update RC2
cpe:2.3:a:philip_moore:windrop:1.5.4:rc2:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2009-1789

Top countries where our scanners detected CVE-2009-1789

Top open port discovered on systems with this issue 80

IPs affected by CVE-2009-1789 202

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2009-1789!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2009-1789

EPSS FAQ

5.49%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 93 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-1789

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

References for CVE-2009-1789

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=528778

#528778 - eggdrop: incomplete patch for CVE-2007-2807 - Debian Bug report logs
http://www.securityfocus.com/bid/34985
http://www.debian.org/security/2009/dsa-1826

[SECURITY] [DSA 1826-1] New eggdrop packages fix several vulnerabilities

CVEs referencing this url
http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0129.html
https://www.exploit-db.com/exploits/8695

Eggdrop/Windrop 1.6.19 - ctcpbuf Remote Crash - Multiple dos Exploit
http://cvs.eggheads.org/viewvc/viewvc.cgi/eggdrop1.6/doc/Changes1.6?revision=1.20&view=markup

Patch;Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01333.html

[SECURITY] Fedora 9 Update: eggdrop-1.6.19-4.fc9
http://www.vupen.com/english/advisories/2009/1340

Site en construction
Patch;Vendor Advisory
http://www.securityfocus.com/archive/1/503574
http://www.mandriva.com/security/advisories?name=MDVSA-2009:126

Mandriva
https://exchange.xforce.ibmcloud.com/vulnerabilities/50547

Eggdrop servmsg.c denial of service CVE-2009-1789 Vulnerability Report
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01337.html

[SECURITY] Fedora 10 Update: eggdrop-1.6.19-4.fc10

Jump to

Vulnerability Details : CVE-2009-1789

Products affected by CVE-2009-1789

Threat overview for CVE-2009-1789

Exploit prediction scoring system (EPSS) score for CVE-2009-1789

CVSS scores for CVE-2009-1789

References for CVE-2009-1789