Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2017-13649 Details

Description

UnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command. NOTE: the vendor indicates that there is no common or recommended scenario in which a root script would execute this kill command.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.5 MEDIUMVector:CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://bugs.unrealircd.org/view.php?id=4990 CVEIssue TrackingThird Party Advisory
http://www.securityfocus.com/bid/100507 CVEThird Party AdvisoryVDB Entry
https://bugs.unrealircd.org/view.php?id=4990 [email protected]Issue TrackingThird Party Advisory
http://www.securityfocus.com/bid/100507 [email protected]Third Party AdvisoryVDB Entry

Weakness Enumeration

CWE-IDCWE NameSource
CWE-665Improper Initialization[email protected]

Affected Products

ProductVersions
unrealircd unrealircd
<= 4.0.13

CPE

  • cpe:2.3:a:unrealircd:unrealircd:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2017-13649
NVD Published Date:
Aug 23, 2017
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2017-13649 Details - Not Deferred