Re: Eggrop bug

From: Giuseppe (giusc_at_gbss.it)
Date: 02/10/04

  • Next message: Marc Maiffret: "EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption" 
    Date: Tue, 10 Feb 2004 19:00:24 +0100
To: bugtraq@securityfocus.com

    >Thankfully resync sharing is considered broken and most people do not
    >use it. Indeed though, this is a bug and thank you for finding it.

    that's not exactly true; yes, many people don't use resync, but..

    char *share_start(Function *global_funcs)
    {
    ....................
       add_hook(HOOK_SHAREIN, (Function) sharein_mod);
       add_hook(HOOK_MINUTELY, (Function) check_expired_tbufs);
    ^^^^^^^^^
       add_hook(HOOK_READ_USERFILE, (Function) hook_read_userfile);
    ....................
    }

    the function, however, is called minutely, so the bug exists also if resync
    is disabled.
    As in previous mail has been already said, check_expired_tbufs() first
    check for timed out resync buffers, then, "accomplish to handle userfile
    requests in limbo (that haven't received yet any response from tandem bot)".

    >Where did you notify eggheads? I seem to be blind while looking for it.

    We've notified you at bugs@eggheads.org; in a private e-mail i''ve sent to
    you the response we received.

    With respect,
    giuseppe

  • Next message: Marc Maiffret: "EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"