Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Instant Messaging/IRC/Chat)  >   snircd Vendors:
snircd send_user_mode() Validation Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID:  1019688
SecurityTracker URL:
CVE Reference:   CVE-2008-1501   (Links to External Site)
Updated:  Apr 18 2008
Original Entry Date:  Mar 24 2008
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.3.4 and prior versions
Description:   A vulnerability was reported in snircd. A remote user can cause denial of service conditions.

A remote user can send specially crafted data to cause the target service to crash.

The vulnerability resides in the send_user_mode() function in 's_user.c'.

A demonstration exploit is provided:

/mode nickname i i i i i i i i i i i i i i i r r r r s

QuakeNet reported this vulnerability.

Impact:   A remote user can cause the target service to crash.
Solution:   The vendor has issued a patch, available at:

Vendor URL: (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.

 Source Message Contents

Subject:  [Full-disclosure] ircu/snircd remote crash vulnerability

Affected software

ircu (upto and including
snircd (upto and including 1.3.4)
and many other ircu derivatives

Vulnerability details

send_user_mode in s_user.c does not check that the argument after a +r mode 
is present, if it is not than the NULL sentinel may be missed, causing the 
function to iterate over the boundary of the array.

One possible exploit:
/mode nickname i i i i i i i i i i i i i i i r r r r s

This won't work if there's another NULL directly after the first from the 
previous parsed command, if this is the case one can just append more modes 
or send some other junk to the ircd.


Upgrade to the very latest version of ircu/snircd.

Disclosure timeline

2008-03-15: Vulnerability discovered by QuakeNet and reported to Undernet.
2008-03-15: Patches released.
2008-03-17: Patches applied to public servers.
2008-03-24: Public disclosure.

Chris Porter (slug on QuakeNet)

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC