Login Sign Up

CVE-2021-29376

7.5 HIGH
Denial of Service

📋 TL;DR

This vulnerability in ircII IRC client allows remote attackers to crash the client via a specially crafted CTCP UTC message, causing denial of service by disconnecting the victim from IRC servers. It affects users of ircII IRC client versions before March 14, 2021.

💻 Affected Systems

Products:
  • ircII
Versions: All versions before 20210314
Operating Systems: Linux, Unix-like systems, BSD variants
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects ircII IRC client users connecting to IRC networks. Other IRC clients are not affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Ircii by Eterna

View all CVEs affecting Ircii →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Malicious actor could mass-disconnect users from IRC networks, disrupting communication channels and causing service outages for IRC-dependent systems.

🟠

Likely Case

Targeted disconnection of specific users from IRC servers, potentially disrupting ongoing conversations or automated bot operations.

🟢

If Mitigated

Minimal impact with patched client or network filtering of malicious CTCP messages.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploit requires sending specially crafted CTCP UTC message to target user on IRC network. No authentication needed beyond ability to send messages.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 20210314 or later

Vendor Advisory: http://www.eterna.com.au/ircii/

Restart Required: Yes

Instructions:

1. Download latest ircII from http://www.eterna.com.au/ircii/ 2. Compile and install according to included instructions 3. Restart ircII client

🔧 Temporary Workarounds

Disable CTCP UTC responses

all

Configure ircII to ignore or not respond to CTCP UTC requests

/set ctcp_reply_utc off

Use IRC server filtering

all

Configure IRC server to filter or block CTCP UTC messages

🧯 If You Can't Patch

  • Switch to alternative IRC client not affected by this vulnerability
  • Implement network monitoring to detect and block malicious CTCP UTC messages

🔍 How to Verify

Check if Vulnerable:

Check ircII version with /version command or run 'ircII --version' from terminal

Check Version:

ircII --version

Verify Fix Applied:

Verify installed version is 20210314 or later and test with known exploit payload

📡 Detection & Monitoring

Log Indicators:

  • ircII segmentation fault logs
  • Unexpected client disconnections
  • CTCP UTC messages with unusual content

Network Indicators:

  • CTCP UTC messages with crafted payloads
  • Multiple disconnection events from same source

SIEM Query:

source="irc*" AND (message="segmentation fault" OR message="crash" OR message="CTCP UTC")

📊 Metadata

CVE ID: CVE-2021-29376
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: March 30, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON