Re: Unrealircd & Anope services - join segmentation fault in operserv.c

From: Sean Kelly (smkelly_at_zombie.org)
Date: 07/08/03

  • Next message: Hugo : "Qt temporary files race condition in Knoppix 3.1"
    Date: Tue, 8 Jul 2003 12:01:07 -0500
    To: Lethalman <lethalman@libero.it>
    
    
    

    On Tue, Jul 08, 2003 at 07:14:22AM -0000, Lethalman wrote:
    > If an admin say this command: '/msg operserv raw
    > :nickserv join #chan' NickServ join in that chan, ok.
    > If the command was: '/msg operserv raw : join #chan'
    > ircd go to SEGFAULT. Why?

    According to you, the IRC server crashes because ": " is expanded (or,
    rather, interpreted) as the name of the server. This causes the server to
    crash, since servers can't join channels and so forth.

    My question is why any sensible administrator would actually use the RAW
    command on Services to send such a command to an IRC server. The RAW
    command does just as it says; it transmits the raw parameter string to the
    uplink server. This can only be done by Services administrators, who are
    supposed to be responsible enough not to send strings to the IRC server
    which will crash it.

    This "exploit" only seems like it would be usable after the server->server
    authentication/link process has completed, and therefore presents no risk
    from users who you do not trust.

    Your advisory is akin to telling somebody not to stab his friend in the
    chest with a pitchfork.

    > Case 1: operserv ordine to a nick (NickServ) to join #chan
    > Case 2: operserv ordine to server to join #chan
    > Ircd go to SEGFAULT because it don't find that nick
    > (eg. hub.server.net).
    > In fact, if you say: '/msg operserv raw : privmsg #chan
    > bye' the nick is hub.server.net and not OperServ.
    > Solutions?
    > Filter operserv.c in function do_raw or filter ircd
    > function m_join in s_user.c
    >
    > Lethal Lab Member (Lethalman)

    -- 
    Sean Kelly         | PGP KeyID: D2E5E296
    smkelly@zombie.org | http://www.zombie.org
    
    



  • Next message: Hugo : "Qt temporary files race condition in Knoppix 3.1"

    Relevant Pages

    • Re: Dynamic DNS "Spoofing" & IRC
      ... We're using somekind modified darkhex ircd atm and we're coding new one ... > within DNS if reverse lookup is possible. ... and a friend's server that allows for me to ... > Step 3) Run your dyndns script for zoneedit to assign your ip address as ...
      (Bugtraq)
    • Re: binary switching, no killing
      ... >implementing ssl encryption between client and server. ... Our original ircd did ... new server reads and restores server state from udp socket ... This list is provided by the SecurityFocus Security Intelligence Alert ...
      (Pen-Test)
    • Re: IM server for FreeBSD
      ... The other option is IRC running an ircd. ... Is there any IM server for freebsd which can do user authentication by vchkpw? ...
      (freebsd-isp)
    • Re: Hvy Plastic 2 --- Plastic Explosives
      ... Wednesday's update fell victim to a server crash, ... The nuke fest was not a satisfying ending after investing ... The player triggering this crash gets spared the mine damage for his ...
      (rec.games.empire)
    • Cancel IO problems on Server 2003
      ... I have an old monolithic driver that works OK on NT 4.0 and Win 2000 ... I have included a crash dump. ... An API library ... This all works OK on NT 4.0, Win2k and also 2003 Server. ...
      (microsoft.public.development.device.drivers)