[30639] in bugtraq
Re: Unrealircd & Anope services - join segmentation fault in operserv.c
daemon@ATHENA.MIT.EDU (Sean Kelly)
Tue Jul 8 16:03:45 2003
Date: Tue, 8 Jul 2003 12:01:07 -0500
From: Sean Kelly <smkelly@zombie.org>
To: Lethalman <lethalman@libero.it>
Message-ID: <20030708170107.GA17317@edgemaster.zombie.org>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="Nq2Wo0NMKNjxTN9z"
Content-Disposition: inline
In-Reply-To: <20030708071422.17024.qmail@www.securityfocus.com>
--Nq2Wo0NMKNjxTN9z
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Tue, Jul 08, 2003 at 07:14:22AM -0000, Lethalman wrote:
> If an admin say this command: '/msg operserv raw
> :nickserv join #chan' NickServ join in that chan, ok.
> If the command was: '/msg operserv raw : join #chan'
> ircd go to SEGFAULT. Why?
According to you, the IRC server crashes because ": " is expanded (or,
rather, interpreted) as the name of the server. This causes the server to
crash, since servers can't join channels and so forth.
My question is why any sensible administrator would actually use the RAW
command on Services to send such a command to an IRC server. The RAW
command does just as it says; it transmits the raw parameter string to the
uplink server. This can only be done by Services administrators, who are
supposed to be responsible enough not to send strings to the IRC server
which will crash it.
This "exploit" only seems like it would be usable after the server->server
authentication/link process has completed, and therefore presents no risk
=66rom users who you do not trust.
Your advisory is akin to telling somebody not to stab his friend in the
chest with a pitchfork.
> Case 1: operserv ordine to a nick (NickServ) to join #chan
> Case 2: operserv ordine to server to join #chan
> Ircd go to SEGFAULT because it don't find that nick
> (eg. hub.server.net).
> In fact, if you say: '/msg operserv raw : privmsg #chan
> bye' the nick is hub.server.net and not OperServ.
> Solutions?
> Filter operserv.c in function do_raw or filter ircd
> function m_join in s_user.c
>=20
> Lethal Lab Member (Lethalman)
--=20
Sean Kelly | PGP KeyID: D2E5E296
smkelly@zombie.org | http://www.zombie.org
--Nq2Wo0NMKNjxTN9z
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)
iD8DBQE/CvjTPm7A9NLl4pYRAmG4AKCgPTMtaJ6PoeM2jhye3IBy4uB87ACfeJc6
wk9g2XELFxFVosbvZBblgAI=
=ppj+
-----END PGP SIGNATURE-----
--Nq2Wo0NMKNjxTN9z--
