[15671] in bugtraq
Re: remote crash BitchX 1.0c16
daemon@ATHENA.MIT.EDU (Moniz, Troy)
Thu Jul 6 17:01:31 2000
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.4.21.0007050638140.32211-100000@crackrock.net>
Date: Wed, 5 Jul 2000 06:38:42 -0700
Reply-To: mndfreeze@CRACKROCK.NET
From: "Moniz, Troy" <mndfreeze@CRACKROCK.NET>
X-To: Colten Edwards <edwards@bitchx.dimension6.com>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <Pine.LNX.4.10.10007032354590.985-100000@panasync.canuck.ca>
This also affects bitchx 75p3
On Tue, 4 Jul 2000, Colten Edwards wrote:
> There's a small bug in the latest BitchX in which a nasty user can invite
> you to a channel with a %s in it, causing the client to coredump. As alot
> of channels/users on irc use the client, I felt I should post a notice
> about this problem. A small patch is available on
> www.bitchx.com/downloads.html as well as on
> ftp.bitchx.com/pub/BitchX/1.0c16.patch
>
> This is a classic case of printf(variable); where variable contains
> formatting chars. I doubt very much this would lead to a root exploit,
> anyone running any irc client as root, should be examined professionally.
>
> I wish to thank the person who discovered this and reported it to #bitchx
> on efnet, as well as the many emails I received on this subject. We had a
> patch available for this before it widely known..
>
>
> Colten Edwards
> panasync@efnet
>
