[PSA] If you run an IRC server which has SASL enabled then you
probably need to update it as soon as possible
reddit / irc

----------------------------------------------------------------------
Saber_UK · 2016-09-03 20:48

Last night I found an exploit in InspIRCd's SASL implementation which
allows you to gain access to services accounts by faking SSL
fingerprints. Another InspIRCd developer (Adam) later found out that
this vulnerability is not just just limited to InspIRCd and that
Charybdis and UnrealIRCd are also vulnerable.

If you are running one of these server implementations and have SASL
enabled then you should upgrade to:

- Charybdis latest git
- InspIRCd 2.0.23
- Nefarious latest git
- UnrealIRCd 3.2.10.7 or 4.0.6

If you are unable to upgrade immediately then you should disable SASL
support temporarily on either all servers or in services.

Other smaller server implementations and derivatives of the above
three may also be vulnerable but we have been unable to confirm this.

----------------------------------------------------------------------
derpherp128 · 2016-09-03 23:36

Good to hear, thanks.

----------------------------------------------------------------------
d0cx · 2016-09-03 23:59

Thanks for the notification. UnrealIRCd has a patch that can do the
fix on-the-fly on linux/bsd without rebooting.

----------------------------------------------------------------------
Polsaker · 2016-09-04 02:12

You should clarify that this is only for SASL EXTERNAL.

----------------------------------------------------------------------
RShotZz · 2016-09-04 02:33

Good, thanks!