CVE-2009-4016 [中] | Denial of Service（Ircd-Hybrid）

Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.

#	日付	旧 EPSS スコア	新 EPSS スコア	Δ（新 − 旧）
1	2025-03-30	5.53%	4.01%	-1.52%
2	2025-03-29	4.01%	5.53%	+1.52%
3	2025-03-17	—	4.01%	—

日付

旧 EPSS スコア

新 EPSS スコア

Δ（新 − 旧）

2025-03-30

5.53%

4.01%

-1.52%

2025-03-29

4.01%

5.53%

+1.52%

2025-03-17

—

4.01%

—

ベーススコア	バージョン	深刻度	ベクトル	悪用しやすさ	影響	スコアの出典
6.8	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:P/I:P/A:P` クリックして展開アクセス経路 (AV:N) ルーティング可能なネットワーク越しに、遠隔から到達・悪用しうる。アクセスの複雑さ (AC:M) 多少の有利条件は要るが、極端なレアケースではない。認証 (AU:N) 認証を経ずに攻撃を完結できる。機密性への影響 (C:P) 機密性は部分的に損なわれる。完全性への影響 (I:P) 完全性は部分的に損なわれる。可用性への影響 (A:P) 可用性は部分的に損なわれる。	8.6	6.4	[email protected]

ベーススコア

バージョン

深刻度

ベクトル

悪用しやすさ

影響

スコアの出典

6.8

2.0

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P クリックして展開

アクセス経路 (AV:N): ルーティング可能なネットワーク越しに、遠隔から到達・悪用しうる。
アクセスの複雑さ (AC:M): 多少の有利条件は要るが、極端なレアケースではない。
認証 (AU:N): 認証を経ずに攻撃を完結できる。
機密性への影響 (C:P): 機密性は部分的に損なわれる。
完全性への影響 (I:P): 完全性は部分的に損なわれる。
可用性への影響 (A:P): 可用性は部分的に損なわれる。

8.6

6.4

[email protected]

CVE-2009-4016 の OS トラッカー

vendor	priority	summary	link
`debian`	medium	CVE-2009-4016 medium priority: Debian including 1 source packages (ircd-hybrid), 4 status rows across 4 suites (bookworm, bullseye, sid, trixie): resolved 4.	https://security-tracker.debian.org/tracker/CVE-2009-4016
`redhat`	critical	—	https://access.redhat.com/security/cve/CVE-2009-4016
`ubuntu`	medium	CVE-2009-4016 medium priority: Ubuntu including 3 source packages (ircd-hybrid, ircd-ratbox, oftc-hybrid), 72 status rows across 24 suites (artful, bionic, cosmic, dapper, hardy, intrepid, jaunty, karmic, lucid, maverick, natty, oneiric, precise, quantal, raring, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): ignored 27, released 23, DNE 20, needs-triage 2.	https://ubuntu.com/security/CVE-2009-4016

CVE-2009-4016 の影響を受けるソフトウェア／構成

ベンダー	製品	バージョン	生の CPE
ircd-hybrid	ircd-hybrid	7.2.2	cpe:2.3:a:ircd-hybrid:ircd-hybrid:7.2.2:::::::*
ircd-hybrid	ircd-hybrid	7.2.3	cpe:2.3:a:ircd-hybrid:ircd-hybrid:7.2.3:::::::*
ircd-ratbox	ircd-ratbox	<= 2.2.8	cpe:2.3:a:ircd-ratbox:ircd-ratbox::::::::
ircd-ratbox	ircd-ratbox	1.0	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.0:::::::*
ircd-ratbox	ircd-ratbox	1.1	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.1:::::::*
ircd-ratbox	ircd-ratbox	1.1.1	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.1.1:::::::*
ircd-ratbox	ircd-ratbox	1.1.2	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.1.2:::::::*
ircd-ratbox	ircd-ratbox	1.2.1	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.2.1:::::::*
ircd-ratbox	ircd-ratbox	1.2.2	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.2.2:::::::*
ircd-ratbox	ircd-ratbox	1.2.3	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.2.3:::::::*
ircd-ratbox	ircd-ratbox	1.3	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.3:::::::*
ircd-ratbox	ircd-ratbox	1.3.1	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.3.1:::::::*
ircd-ratbox	ircd-ratbox	1.3.2	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.3.2:::::::*
ircd-ratbox	ircd-ratbox	1.4	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.4:::::::*
ircd-ratbox	ircd-ratbox	1.4	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.4:rc1::::::
ircd-ratbox	ircd-ratbox	1.4	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.4:rc2::::::
ircd-ratbox	ircd-ratbox	1.4.1	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.4.1:::::::*
ircd-ratbox	ircd-ratbox	1.4.2	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.4.2:::::::*
ircd-ratbox	ircd-ratbox	1.5	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.5:::::::*
ircd-ratbox	ircd-ratbox	1.5.1	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.5.1:::::::*
ircd-ratbox	ircd-ratbox	1.5.2	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.5.2:::::::*
ircd-ratbox	ircd-ratbox	1.5.3	cpe:2.3:a:ircd-ratbox:ircd-ratbox:1.5.3:::::::*
ircd-ratbox	ircd-ratbox	2.0.0	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.0:::::::*
ircd-ratbox	ircd-ratbox	2.0.1	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.1:::::::*
ircd-ratbox	ircd-ratbox	2.0.2	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.2:::::::*
ircd-ratbox	ircd-ratbox	2.0.3	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.3:::::::*
ircd-ratbox	ircd-ratbox	2.0.4	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.4:::::::*
ircd-ratbox	ircd-ratbox	2.0.5	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.5:::::::*
ircd-ratbox	ircd-ratbox	2.0.6	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.6:::::::*
ircd-ratbox	ircd-ratbox	2.0.7	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.7:::::::*
ircd-ratbox	ircd-ratbox	2.0.8	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.8:::::::*
ircd-ratbox	ircd-ratbox	2.0.9	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.9:::::::*
ircd-ratbox	ircd-ratbox	2.0.10	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.10:::::::*
ircd-ratbox	ircd-ratbox	2.0.11	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.0.11:::::::*
ircd-ratbox	ircd-ratbox	2.1.0	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.0:::::::*
ircd-ratbox	ircd-ratbox	2.1.0	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.0:beta1::::::
ircd-ratbox	ircd-ratbox	2.1.0	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.0:beta2::::::
ircd-ratbox	ircd-ratbox	2.1.1	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.1:::::::*
ircd-ratbox	ircd-ratbox	2.1.2	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.2:::::::*
ircd-ratbox	ircd-ratbox	2.1.3	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.3:::::::*
ircd-ratbox	ircd-ratbox	2.1.4	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.4:::::::*
ircd-ratbox	ircd-ratbox	2.1.5	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.5:::::::*
ircd-ratbox	ircd-ratbox	2.1.6	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.6:::::::*
ircd-ratbox	ircd-ratbox	2.1.7	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.7:::::::*
ircd-ratbox	ircd-ratbox	2.1.8	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.1.8:::::::*
ircd-ratbox	ircd-ratbox	2.2.0	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.0:::::::*
ircd-ratbox	ircd-ratbox	2.2.0	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.0:rc1::::::
ircd-ratbox	ircd-ratbox	2.2.0	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.0:rc2::::::
ircd-ratbox	ircd-ratbox	2.2.0	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.0:rc3::::::
ircd-ratbox	ircd-ratbox	2.2.1	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.1:::::::*
ircd-ratbox	ircd-ratbox	2.2.2	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.2:::::::*
ircd-ratbox	ircd-ratbox	2.2.3	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.3:::::::*
ircd-ratbox	ircd-ratbox	2.2.4	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.4:::::::*
ircd-ratbox	ircd-ratbox	2.2.5	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.5:::::::*
ircd-ratbox	ircd-ratbox	2.2.6	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.6:::::::*
ircd-ratbox	ircd-ratbox	2.2.7	cpe:2.3:a:ircd-ratbox:ircd-ratbox:2.2.7:::::::*
oftc	oftc-hybrid	<= 1.6.7	cpe:2.3:a:oftc:oftc-hybrid::::::::
oftc	oftc-hybrid	1.4.0	cpe:2.3:a:oftc:oftc-hybrid:1.4.0:::::::*
oftc	oftc-hybrid	1.4.1	cpe:2.3:a:oftc:oftc-hybrid:1.4.1:::::::*
oftc	oftc-hybrid	1.5.0	cpe:2.3:a:oftc:oftc-hybrid:1.5.0:::::::*
oftc	oftc-hybrid	1.5.1	cpe:2.3:a:oftc:oftc-hybrid:1.5.1:::::::*
oftc	oftc-hybrid	1.5.2	cpe:2.3:a:oftc:oftc-hybrid:1.5.2:::::::*
oftc	oftc-hybrid	1.5.3	cpe:2.3:a:oftc:oftc-hybrid:1.5.3:::::::*
oftc	oftc-hybrid	1.5.4	cpe:2.3:a:oftc:oftc-hybrid:1.5.4:::::::*
oftc	oftc-hybrid	1.5.5	cpe:2.3:a:oftc:oftc-hybrid:1.5.5:::::::*
oftc	oftc-hybrid	1.5.6	cpe:2.3:a:oftc:oftc-hybrid:1.5.6:::::::*
oftc	oftc-hybrid	1.5.7	cpe:2.3:a:oftc:oftc-hybrid:1.5.7:::::::*
oftc	oftc-hybrid	1.6.0	cpe:2.3:a:oftc:oftc-hybrid:1.6.0:::::::*
oftc	oftc-hybrid	1.6.1	cpe:2.3:a:oftc:oftc-hybrid:1.6.1:::::::*
oftc	oftc-hybrid	1.6.2	cpe:2.3:a:oftc:oftc-hybrid:1.6.2:::::::*
oftc	oftc-hybrid	1.6.3	cpe:2.3:a:oftc:oftc-hybrid:1.6.3:::::::*
oftc	oftc-hybrid	1.6.4	cpe:2.3:a:oftc:oftc-hybrid:1.6.4:::::::*
oftc	oftc-hybrid	1.6.5	cpe:2.3:a:oftc:oftc-hybrid:1.6.5:::::::*
oftc	oftc-hybrid	1.6.6	cpe:2.3:a:oftc:oftc-hybrid:1.6.6:::::::*

CVE-2009-4016 の参考情報

URL	タグ
http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html
http://secunia.com/advisories/38210	Vendor Advisory
http://secunia.com/advisories/38381	Vendor Advisory
http://secunia.com/advisories/38382	Vendor Advisory
http://secunia.com/advisories/38383	Vendor Advisory
http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid_7.2.2.dfsg.2-4+lenny1.diff.gz	Patch
http://svn.ircd-hybrid.org:8000/viewcvs.cgi?rev=1044&view=rev
http://trac.oftc.net/projects/oftc-hybrid/browser/tags/oftc-hybrid-1.6.8/RELNOTES
http://www.debian.org/security/2010/dsa-1980	Patch
http://www.securityfocus.com/bid/37978

URL

タグ

http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html

http://secunia.com/advisories/38210

Vendor Advisory

http://secunia.com/advisories/38381

Vendor Advisory

http://secunia.com/advisories/38382

Vendor Advisory

http://secunia.com/advisories/38383

Vendor Advisory

http://security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid_7.2.2.dfsg.2-4+lenny1.diff.gz