SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Instant Messaging/IRC/Chat)  >   snircd Vendors:   quakenet.org
snircd send_user_mode() Validation Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID:  1019688
SecurityTracker URL:  http://securitytracker.com/id/1019688
CVE Reference:   CVE-2008-1501   (Links to External Site)
Updated:  Apr 18 2008
Original Entry Date:  Mar 24 2008
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.3.4 and prior versions
Description:   A vulnerability was reported in snircd. A remote user can cause denial of service conditions.

A remote user can send specially crafted data to cause the target service to crash.

The vulnerability resides in the send_user_mode() function in 's_user.c'.

A demonstration exploit is provided:

/mode nickname i i i i i i i i i i i i i i i r r r r s

QuakeNet reported this vulnerability.

Impact:   A remote user can cause the target service to crash.
Solution:   The vendor has issued a patch, available at:

http://hg.quakenet.org/snircd/rev/2da2b881d9f5

Vendor URL:  hg.quakenet.org/snircd/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] ircu/snircd remote crash vulnerability

Affected software
-----------------

ircu (upto and including 2.10.12.12)
snircd (upto and including 1.3.4)
and many other ircu derivatives

Vulnerability details
---------------------

send_user_mode in s_user.c does not check that the argument after a +r mode 
is present, if it is not than the NULL sentinel may be missed, causing the 
function to iterate over the boundary of the array.

One possible exploit:
/mode nickname i i i i i i i i i i i i i i i r r r r s

This won't work if there's another NULL directly after the first from the 
previous parsed command, if this is the case one can just append more modes 
or send some other junk to the ircd.

Resolution
----------

Upgrade to the very latest version of ircu/snircd.

Disclosure timeline
-------------------

2008-03-15: Vulnerability discovered by QuakeNet and reported to Undernet.
2008-03-15: Patches released.
2008-03-17: Patches applied to public servers.
2008-03-24: Public disclosure.

-- 
Chris Porter (slug on QuakeNet)
http://www.warp13.co.uk

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC