[11038] in bugtraq
Re: ircd exploit in ircu based code
daemon@ATHENA.MIT.EDU (Kev)
Fri Jul 16 14:19:27 1999
Message-Id: <199907151739.NAA06300@all-night-tool.mit.edu>
Date: Thu, 15 Jul 1999 13:39:46 EDT
Reply-To: Kev <klmitch@MIT.EDU>
From: Kev <klmitch@MIT.EDU>
X-To: Kevin Day <toasty@DRAGONDATA.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: Your message of "Tue, 13 Jul 1999 20:49:02 CDT."
<199907140149.UAA21225@celery.dragondata.com>
> Most irc networks using ircu based servers have a bug that can cause users
> to segfault the server.
>
> In m_join, the code doesn't check to see if get_channel returned failure (by
> returning NULL).
Which version of ircu? In 2.10.06, the only pattern that matches your
patch is wrapped within "if (*mbuf)"; by this time in m_join, the channel
is known to exist, and we're just sending modes off to the P09 servers.
(And we're calling sendto_lowprot_butone() instead.)
> While the line numbers will probably be off, this patch will work in most
> ircu based servers.
>
> --- ircd/channel.c Tue Jul 13 19:58:46 1999
> +++ ircd/channel.c Tue Jul 13 20:05:31 1999
> @@ -2004,6 +2004,12 @@
>
> chptr = get_channel (sptr, name, !CREATE); /* need the TS -Kev */
>
> + if (!chptr) {
> + sendto_one (sptr, err_str (ERR_NOSUCHCHANNEL),
> + me.name, parv[0], name);
> + return(0);
> + }
> +
> sendto_serv_butone (cptr, ":%s MODE %s +%s%s %lu", me.name, name,
> sendmode ? "o " : "", sendmode ? parv[0] : "",
> chptr->creationtime); /* send the MODE to the
Judging from context (it's been a long time since I wrote this code), this
is the same place as I indicate above, and we already know for a fact that
the channel exists. Perhaps an assertion should go in there...
Also note that your return is misplaced; this is inside a loop, and you
are terminating the loop prematurely. You can easily end up with a desync,
when what should happen is the server should die, because it's lost a
channel while trying to add someone to it!
--
Kevin L. Mitchell <klmitch@mit.edu>
------------------------- -. .---- --.. ..- -..- --------------------------
http://web.mit.edu/klmitch/www/ (PGP keys availiable from here)
RSA AE87D37D/1024: DE EA 1E 99 3F 2B F9 23 A0 D8 05 E0 6F BA B9 D2
DSS ED0DB34E/1024: D9BF 0E74 FDCB 43F5 C597 878F 9455 EC24 ED0D B34E
DH 2A2C31D4/2048: 1A77 4BA5 9E32 14AE 87DA 9FEC 7106 FC62 2A2C 31D4
