Secunia

Two vulnerabilities have been reported in ignitionServer, which can be exploited by malicious users to delete access entries or prevent protected operators from accessing certain channels.

1) According to the IRCX draft, only owners are allowed to delete access entries set by owners. However, this is not checked before access entries are deleted, which breaches channel security and allows hosts to delete access entries set by owners.

2) Due to a design error, protected IRC operators can't access channels created and locked by normal users.

Solution
The vulnerabilities have been fixed in version 0.3.6-P1.
Further details available in Customer Area

Provided and/or discovered by
1) Keith Gable, Lead Programmer of the Ignition Project.
2) WebdesignX007

Changelog
Further details available in Customer Area

Original Advisory
http://www.ignition-project.com/security/20050414-hosts-delete-owner-access-entries
http://www.ignition-project.com/security/20050515-protected-opers-cannot-join-channel-with-key

Deep Links
Links available in Customer Area