Unscored severity · published Mar 1, 2005
CVE-2004-1052
Buffer overflow in the getnickuserhost function in BNC 2.8.9, and possibly other versions, allows remote IRC servers to execute arbitrary code via an IRC server response that…
–
CVSS
3.6%
EPSS
No
On KEV
Description
Buffer overflow in the getnickuserhost function in BNC 2.8.9, and possibly other versions, allows remote IRC servers to execute arbitrary code via an IRC server response that contains many (1) ! (exclamation) or (2) @ (at sign) characters.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BN
Bnc · Bnc
2.2.4; 2.4.6; 2.4.8; 2.6; 2.6.2; 2.6.4; +2 more · source: NVD
DL
Debian Linux · Debian
3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +5 more · source: NVD
LI
Linux · Gentoo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1052
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1052
marc.info
http://marc.info/?l=bugtraq&m=110011817627839&w=2
secunia.com
http://secunia.com/advisories/13149/
security.lss.hr
http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03
www.debian.org
http://www.debian.org/security/2004/dsa-595
Patch
http://www.securityfocus.com/bid/11647
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/18013
More from Bnc
–
CVE-2004-1482
The sbuf_getmsg function in BNC incorrectly handles backspace characters, which could allow remote attackers to bypass authentication and gain access to arbitrary scripts
–
CVE-2004-2612
BNC 2.9.0 only grants access when an incorrect password is provided, which allows remote attackers to use the functionality intended for authorized users