CVE-2017-9468

What it actually does

Remote attackers trigger a NULL pointer dereference in DCC message handling when source nick or host is absent, resulting in an immediate application crash and denial of service.

Why it matters to the business

Causes unplanned downtime for IRC-based communication tools, interrupting operations that depend on stable chat or messaging services and increasing support overhead for affected deployments.

How an attack unfolds

An attacker uses a malicious or compromised IRC server to deliver a DCC message that omits the expected source nick or host fields; the vulnerable client dereferences a NULL pointer during processing and terminates.

How to fix it

Upgrade affected installations to the fixed version 1.16.5 or later; disable DCC support if the feature is unnecessary.

How to confirm the fix worked

Confirm the installed version meets or exceeds the patched release; test handling of a DCC message with missing source fields to verify absence of crash behavior.

Typical attack path

1. Establish a connection from a remote IRC server to the vulnerable client
2. Transmit a specially crafted DCC message lacking nick or host metadata
3. Trigger NULL dereference leading to immediate process crash

How to detect it

Inspect client crash logs, core dumps, or segmentation fault entries that coincide with incoming DCC traffic or IRC message processing.

What your security team should do

• Prioritize upgrade of all instances to the fixed version 1.16.5
• Review and restrict DCC functionality where feasible
• Monitor application logs for sudden crashes during IRC sessions