SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Instant Messaging/IRC/Chat)  >   ircu Vendors:   undernet.org
ircu send_user_mode() Validation Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID:  1019687
SecurityTracker URL:  http://securitytracker.com/id/1019687
CVE Reference:   CVE-2008-1501   (Links to External Site)
Updated:  Apr 18 2008
Original Entry Date:  Mar 24 2008
Impact:   Denial of service via network
Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 2.10.12.12 and prior versions
Description:   A vulnerability was reported in ircu. A remote user can cause denial of service conditions.

A remote user can send specially crafted data to cause the target service to crash.

The vulnerability resides in the send_user_mode() function in 's_user.c'.

A demonstration exploit is provided:

/mode nickname i i i i i i i i i i i i i i i r r r r s

QuakeNet reported this vulnerability.

Impact:   A remote user can cause denial of service conditions.
Solution:   No solution was available at the time of this entry.
Vendor URL:  coder-com.undernet.org/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] ircu/snircd remote crash vulnerability

Affected software
-----------------

ircu (upto and including 2.10.12.12)
snircd (upto and including 1.3.4)
and many other ircu derivatives

Vulnerability details
---------------------

send_user_mode in s_user.c does not check that the argument after a +r mode 
is present, if it is not than the NULL sentinel may be missed, causing the 
function to iterate over the boundary of the array.

One possible exploit:
/mode nickname i i i i i i i i i i i i i i i r r r r s

This won't work if there's another NULL directly after the first from the 
previous parsed command, if this is the case one can just append more modes 
or send some other junk to the ircd.

Resolution
----------

Upgrade to the very latest version of ircu/snircd.

Disclosure timeline
-------------------

2008-03-15: Vulnerability discovered by QuakeNet and reported to Undernet.
2008-03-15: Patches released.
2008-03-17: Patches applied to public servers.
2008-03-24: Public disclosure.

-- 
Chris Porter (slug on QuakeNet)
http://www.warp13.co.uk

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC