Local Privilege Escalation in UnrealIRCd by Unreal IRC Services

CVE-2017-13649

What is CVE-2017-13649?

UnrealIRCd versions 4.0.13 and earlier are susceptible to a local privilege escalation vulnerability that allows non-root users to modify the PID file generated after the user has dropped privileges. This manipulation could permit these users to terminate arbitrary processes by executing a command that attempts to kill processes based on the PID file's content. While the vendor claims there is no typical scenario where a script running as root would execute this command, the potential for misuse makes this a notable security concern that should be addressed promptly.

References