snircd send_user_mode() Validation Flaw Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1019688
|
|
SecurityTracker URL: http://securitytracker.com/id?1019688
|
|
CVE Reference: CVE-2008-1501
(Links to External Site)
|
Updated: Apr 18 2008
|
Original Entry Date: Mar 24 2008
|
Impact: Denial of service via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 1.3.4 and prior versions
|
Description: A vulnerability was reported in snircd. A remote user can cause denial of service conditions.
A remote user can send specially crafted data to cause the target service to crash.
The vulnerability resides in the send_user_mode()
function in 's_user.c'.
A demonstration exploit is provided:
/mode nickname i i i i i i i i i i i i i i i r r r r s
QuakeNet
reported this vulnerability.
|
Impact: A remote user can cause the target service to crash.
|
Solution: The vendor has issued a patch, available at:
http://hg.quakenet.org/snircd/rev/2da2b881d9f5
|
Vendor URL: hg.quakenet.org/snircd/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: Chris Porter <cdp34@cam.ac.uk>
|
Message History:
None.
|
Source Message Contents
|
Date: 24 Mar 2008 01:29:50 +0000
From: Chris Porter <cdp34@cam.ac.uk>
Subject: [Full-disclosure] ircu/snircd remote crash vulnerability
|
Affected software
-----------------
ircu (upto and including 2.10.12.12)
snircd (upto and including 1.3.4)
and many other ircu derivatives
Vulnerability details
---------------------
send_user_mode in s_user.c does not check that the argument after a +r mode
is present, if it is not than the NULL sentinel may be missed, causing the
function to iterate over the boundary of the array.
One possible exploit:
/mode nickname i i i i i i i i i i i i i i i r r r r s
This won't work if there's another NULL directly after the first from the
previous parsed command, if this is the case one can just append more modes
or send some other junk to the ircd.
Resolution
----------
Upgrade to the very latest version of ircu/snircd.
Disclosure timeline
-------------------
2008-03-15: Vulnerability discovered by QuakeNet and reported to Undernet.
2008-03-15: Patches released.
2008-03-17: Patches applied to public servers.
2008-03-24: Public disclosure.
--
Chris Porter (slug on QuakeNet)
http://www.warp13.co.uk
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
