CVE-2009-4652

Name	CVE-2009-4652
Description	The (1) Conn_GetCipherInfo and (2) Conn_UsesSSL functions in src/ngircd/conn.c in ngIRCd 13 and 14, when SSL/TLS support is present and standalone mode is disabled, allow remote attackers to cause a denial of service (application crash) by sending the MOTD command from another server in the same IRC network, possibly related to an array index error.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ngircd (PTS)	jessie, jessie (lts)	22-2+deb8u1	fixed
	stretch	24-1	fixed
	buster	25-2	fixed
	bullseye	26.1-1+deb11u1	fixed
	bookworm	26.1-1+deb12u1	fixed
	sid, trixie	27-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ngircd	source	lenny	(not affected)
ngircd	source	(unstable)	15-0.1

[lenny] - ngircd <not-affected> (SSL/TLS support not yet present)