Remote DoS Vulnerability in bitchx, ircii < 20210314 and scrollz

[ortmann () posteo de]

Hi,

i discovered a remote DoS vulnerability (crash) that effects bitchx, ircii and
scrollz.

Its unknown if this could also be used for arbitrary code execution.

Affected Versions:

  This bug is very old and affects any version, except
  ircii-20210314, which got a fix.

CVE Name:

  none yet

Problem Description:

  ircii has a bug in parsing CTCP UTC messages. bitchx and scrollz are forks of
  ircii and inherited that feature and bug.

Impact:

  A malicious irc user could nuke any other irc user that uses bitchx, ircii or
  scrollz out of irc (crash their irc client) by connecting to the same irc
  network and sending a malicious CTCP UTC message.

Solution:

  For ircii: Update to ircii-20210314
  For bitchx and scrollz: none yet

History:

  20210302 Vulnerability and PoC reported to:
    bitchx - security () bitchx org
    ircii - mrg () eterna com au
    scrollz - flier () scrollz info
  20210314 ircii released a fixed version

light and love,
Michael Ortmann