CVE-2013-6404
First published: Mon Dec 09 2013(Updated: )
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Quassel IRC | <=0.9.1 | |
| Quassel IRC | =0.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html
- http://osvdb.org/100432
- http://quassel-irc.org/node/123
- http://secunia.com/advisories/55640
- http://www.openwall.com/lists/oss-security/2013/11/28/8
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89377
- https://github.com/quassel/quassel/commit/a1a24da
Frequently Asked Questions
What is the severity of CVE-2013-6404?
CVE-2013-6404 is rated as a medium severity vulnerability due to improper user ID verification leading to unauthorized access.
How do I fix CVE-2013-6404?
To fix CVE-2013-6404, upgrade Quassel IRC to version 0.9.2 or later, which addresses the user ID verification issue.
Which versions of Quassel IRC are affected by CVE-2013-6404?
Quassel IRC versions prior to 0.9.2, specifically 0.9.0 and 0.9.1, are affected by CVE-2013-6404.
What can be exploited in CVE-2013-6404?
CVE-2013-6404 can be exploited by remote authenticated users to read other users' backlogs without authorization.
Is there a workaround for CVE-2013-6404 if I cannot upgrade?
There is no documented workaround for CVE-2013-6404, so upgrading to a secure version is necessary.
- agent/references
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/quassel-irc
- canonical/quassel irc
- version/quassel irc/0.9.1
- version/quassel irc/0.9.0