Read the docs
TI-2009-04649 Aliases CVE-2009-4893GHSA-cp64-jc72-8g82

Buffer overflow in UnrealIRCd 3.2beta11 through 3.2.8, when allow::options::noident is…

Priority LOW 35CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Buffer overflow in UnrealIRCd 3.2beta11 through 3.2.8, when allow::options::noident is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

Why it matters now

EPSS 0.02512 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:a:unrealircd:unrealircd:3.2:beta11:*:*:*:*:*:*3.2 beta11VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.1:pre1:*:*:*:*:*:*3.2.1 pre1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.1:pre2:*:*:*:*:*:*3.2.1 pre2VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.2:pre1:*:*:*:*:*:*3.2.2 pre1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.3:pre1:*:*:*:*:*:*3.2.3 pre1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.3:pre2:*:*:*:*:*:*3.2.3 pre2VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.3:pre3:*:*:*:*:*:*3.2.3 pre3VulnerableUnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2:beta11:*:*:*:*:*:* Versions 3.2 beta11 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.1:pre1:*:*:*:*:*:* Versions 3.2.1 pre1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.1:pre2:*:*:*:*:*:* Versions 3.2.1 pre2 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.2:pre1:*:*:*:*:*:* Versions 3.2.2 pre1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.3:pre1:*:*:*:*:*:* Versions 3.2.3 pre1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.3:pre2:*:*:*:*:*:* Versions 3.2.3 pre2 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.3:pre3:*:*:*:*:*:* Versions 3.2.3 pre3 Vulnerable ·UnrealIRCd
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:unrealircd:unrealircd:3.2.3:pre4:*:*:*:*:*:*3.2.3 pre4VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.4:pre1:*:*:*:*:*:*3.2.4 pre1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.4:pre2:*:*:*:*:*:*3.2.4 pre2VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.4:rc1:*:*:*:*:*:*3.2.4 rc1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.4:rc2:*:*:*:*:*:*3.2.4 rc2VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.4:rc3:*:*:*:*:*:*3.2.4 rc3VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.5:*:*:*:*:*:*:*3.2.5VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.5:rc1:*:*:*:*:*:*3.2.5 rc1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.5:rc2:*:*:*:*:*:*3.2.5 rc2VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.5:rc3:*:*:*:*:*:*3.2.5 rc3VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.6:*:*:*:*:*:*:*3.2.6VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.6:rc1:*:*:*:*:*:*3.2.6 rc1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.6:rc2:*:*:*:*:*:*3.2.6 rc2VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.6:rc3:*:*:*:*:*:*3.2.6 rc3VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.7:*:*:*:*:*:*:*3.2.7VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.7:rc1:*:*:*:*:*:*3.2.7 rc1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.7:rc2:*:*:*:*:*:*3.2.7 rc2VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.8:*:*:*:*:*:*:*3.2.8VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.8:rc1:*:*:*:*:*:*3.2.8 rc1VulnerableUnrealIRCd
cpe:2.3:a:unrealircd:unrealircd:3.2.8:rc2:*:*:*:*:*:*3.2.8 rc2VulnerableUnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.3:pre4:*:*:*:*:*:* Versions 3.2.3 pre4 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.4:pre1:*:*:*:*:*:* Versions 3.2.4 pre1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.4:pre2:*:*:*:*:*:* Versions 3.2.4 pre2 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.4:rc1:*:*:*:*:*:* Versions 3.2.4 rc1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.4:rc2:*:*:*:*:*:* Versions 3.2.4 rc2 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.4:rc3:*:*:*:*:*:* Versions 3.2.4 rc3 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.5:rc1:*:*:*:*:*:* Versions 3.2.5 rc1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.5:rc2:*:*:*:*:*:* Versions 3.2.5 rc2 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.5:rc3:*:*:*:*:*:* Versions 3.2.5 rc3 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.6:rc1:*:*:*:*:*:* Versions 3.2.6 rc1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.6:rc2:*:*:*:*:*:* Versions 3.2.6 rc2 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.6:rc3:*:*:*:*:*:* Versions 3.2.6 rc3 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.7:*:*:*:*:*:*:* Versions 3.2.7 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.7:rc1:*:*:*:*:*:* Versions 3.2.7 rc1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.7:rc2:*:*:*:*:*:* Versions 3.2.7 rc2 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.8:*:*:*:*:*:*:* Versions 3.2.8 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.8:rc1:*:*:*:*:*:* Versions 3.2.8 rc1 Vulnerable ·UnrealIRCd
  • cpe:2.3:a:unrealircd:unrealircd:3.2.8:rc2:*:*:*:*:*:* Versions 3.2.8 rc2 Vulnerable ·UnrealIRCd

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-4893
  2. 2026-10-03 Alias added: GHSA-cp64-jc72-8g82

References

Advisory 2

Other 1

  • TI-2010-01989 UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through… CVSS 2.0HIGH 7.5
  • TI-2016-06143 The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x… CVSS 3.0HIGH 8.1
  • TI-2023-27714 A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an… CVSS 3.1HIGH 7.5
  • TI-2013-06048 UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers to cause a denial of service… CVSS 2.0MEDIUM 5.0
  • TI-2013-05367 Use-after-free vulnerability in UnrealIRCd 3.2.10 before 3.2.10.2 allows remote attackers… CVSS 2.0MEDIUM 5.0
  • TI-2017-09939 UnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root… CVSS 3.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences