CVE-2009-4016
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3...
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
Exploit likelihood
What each source reports
NVD Score used
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
- Record
CVE-2009-4016- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
- Record
CVE-2009-4016- Updated
- 2026-11-02
EUVDEUVD-2009-3987 No score
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
- Record
EUVD-2009-3987- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hxqm-w72v-m7v5 No score
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3...
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
- Record
GHSA-hxqm-w72v-m7v5- Updated
- 2026-11-02
OSV No score
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
- Record
CVE-2009-4016- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-4016 No score
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
- Record
DEBIAN-CVE-2009-4016- Updated
- 2026-11-02
OSVUBUNTU-CVE-2009-4016 No score
Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oftc-hybrid before 1.6.8, when flatten_links is disabled, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a LINKS command.
- Record
UBUNTU-CVE-2009-4016- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ircd-hybridDebian:12 |
before 1:7.2.2.dfsg.2-6.1 | 1:7.2.2.dfsg.2-6.1 |
ircd-hybridDebian:13 |
before 1:7.2.2.dfsg.2-6.1 | 1:7.2.2.dfsg.2-6.1 |
ircd-ratboxDebian:5.0 From an advisory covering 2 CVEs |
before 2.2.8.dfsg-2+lenny1, plus listed versions 2.2.8.dfsg-2 |
2.2.8.dfsg-2+lenny1 |
ircd-hybridDebian:4.0 From an advisory covering 2 CVEs |
before 1:7.2.2.dfsg.2-3+etch1, plus listed versions 1:7.2.2.dfsg.2-3 |
1:7.2.2.dfsg.2-3+etch1 |
ircd-hybridDebian:5.0 From an advisory covering 2 CVEs |
before 1:7.2.2.dfsg.2-4+lenny1, plus listed versions 1:7.2.2.dfsg.2-4 |
1:7.2.2.dfsg.2-4+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-4016 is a medium vulnerability (CVSS 6.8) in Ircd-hybrid, published January 27, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.03%, the 90th percentile. Fixed in ircd-hybrid 1:7.2.2.dfsg.2-6.1.
References
secunia.com/advisories/38382
lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html
debian.org/security/2010/dsa-1980
trac.oftc.net/projects/oftc-hybrid/browser/tags/oftc-hybrid-1.6.8/RELNOTES
Show 9 moreShow less
securityfocus.com/bid/37978
svn.ircd-hybrid.org/viewcvs.cgi?rev=1044&view=rev
security.debian.org/pool/updates/main/i/ircd-hybrid/ircd-hybrid_7.2.2.dfsg.2-4+lenny1.diff.gz
nvd.nist.gov/vuln/detail/CVE-2009-4016
github.com/advisories/GHSA-hxqm-w72v-m7v5
security-tracker.debian.org/tracker/CVE-2009-4016
ubuntu.com/security/CVE-2009-4016
cve.org/CVERecord?id=CVE-2009-4016