This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig991E9DF6B1DE0588462A861B
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200606-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: EnergyMech: Denial of Service
Date: June 26, 2006
Bugs: #132749
ID: 200606-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
=3D=3D=3D=3D=3D=3D=3D=3D
A Denial of Service vulnerability was discovered in EnergyMech that is
easily exploitable via IRC.
Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
EnergyMech is an IRC bot programmed in C.
Affected packages
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-irc/emech < 3.0.2 >=3D 3.0.2
Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
A bug in EnergyMech fails to handle empty CTCP NOTICEs correctly, and
will cause a crash from a segmentation fault.
Impact
=3D=3D=3D=3D=3D=3D
By sending an empty CTCP NOTICE, a remote attacker could exploit this
vulnerability to cause a Denial of Service.
Workaround
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
There is no known workaround at this time.
Resolution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
All EnergyMech users should update to the latest stable version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=3Dnet-irc/emech-3.0.2"
References
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[ 1 ] EnergyMech Changelog
http://www.energymech.net/versions-3.0.html
Availability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200606-26.xml
Concerns?
=3D=3D=3D=3D=3D=3D=3D=3D=3D
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=3D=3D=3D=3D=3D=3D=3D
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--------------enig991E9DF6B1DE0588462A861B
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFEoDQwvcL1obalX08RAi3GAKCe70z1M7pZH5vHdtZbfX1i9brdfwCfb2m1
pObY40lgM8ZH+8n2MjdwDsQ=
=rKc5
-----END PGP SIGNATURE-----
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig991E9DF6B1DE0588462A861B
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200606-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: EnergyMech: Denial of Service
Date: June 26, 2006
Bugs: #132749
ID: 200606-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
A Denial of Service vulnerability was discovered in EnergyMech that is
easily exploitable via IRC.
Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
EnergyMech is an IRC bot programmed in C.
Affected packages
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-irc/emech < 3.0.2 >=3D 3.0.2
Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
A bug in EnergyMech fails to handle empty CTCP NOTICEs correctly, and
will cause a crash from a segmentation fault.
Impact
=3D=3D=3D=3D=3D=3D
By sending an empty CTCP NOTICE, a remote attacker could exploit this
vulnerability to cause a Denial of Service.
Workaround
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
There is no known workaround at this time.
Resolution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
All EnergyMech users should update to the latest stable version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=3Dnet-irc/emech-3.0.2"
References
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[ 1 ] EnergyMech Changelog
http://www.energymech.net/versions-3.0.html
Availability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200606-26.xml
Concerns?
=3D=3D=3D=3D=3D=3D=3D=3D=3D
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=3D=3D=3D=3D=3D=3D=3D
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--------------enig991E9DF6B1DE0588462A861B
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFEoDQwvcL1obalX08RAi3GAKCe70z1M7pZH5vHdtZbfX1i9brdfwCfb2m1
pObY40lgM8ZH+8n2MjdwDsQ=
=rKc5
-----END PGP SIGNATURE-----
--------------enig991E9DF6B1DE0588462A861B--
--
mailing list
