Unscored severity · published Dec 31, 2004
CVE-2004-2612
BNC 2.9.0 only grants access when an incorrect password is provided, which allows remote attackers to use the functionality intended for authorized users
–
CVSS
1.5%
EPSS
No
On KEV
Description
BNC 2.9.0 only grants access when an incorrect password is provided, which allows remote attackers to use the functionality intended for authorized users.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BN
Bnc · Bnc
2.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2612
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2612
Patch
http://secunia.com/advisories/13302
www.gotbnc.com
http://www.gotbnc.com/changes.html#2.9.1
Patch
http://www.osvdb.org/12144
Patch
http://www.securityfocus.com/bid/11650
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/18103
More from Bnc
–
CVE-2004-1052
Buffer overflow in the getnickuserhost function in BNC 2.8.9, and possibly other versions, allows remote IRC servers to execute arbitrary code via an IRC server response that…
–
CVE-2004-1482
The sbuf_getmsg function in BNC incorrectly handles backspace characters, which could allow remote attackers to bypass authentication and gain access to arbitrary scripts