snircd <= 1.3.4 (send_user_mode) Denial of Service Vulnerability

🗓️ 25 Mar 2008 00:00:00Reported by RootType

snircd <= 1.3.4 (send_user_mode) DoS Vulnerability in ircu derivative


                                                Affected&nbsp;software
-----------------

ircu&nbsp;(upto&nbsp;and&nbsp;including&nbsp;2.10.12.12)
snircd&nbsp;(upto&nbsp;and&nbsp;including&nbsp;1.3.4)
and&nbsp;many&nbsp;other&nbsp;ircu&nbsp;derivatives

Vulnerability&nbsp;details
---------------------

send_user_mode&nbsp;in&nbsp;s_user.c&nbsp;does&nbsp;not&nbsp;check&nbsp;that&nbsp;the&nbsp;argument&nbsp;after&nbsp;a&nbsp;+r&nbsp;mode&nbsp;
is&nbsp;present,&nbsp;if&nbsp;it&nbsp;is&nbsp;not&nbsp;than&nbsp;the&nbsp;NULL&nbsp;sentinel&nbsp;may&nbsp;be&nbsp;missed,&nbsp;causing&nbsp;the&nbsp;
function&nbsp;to&nbsp;iterate&nbsp;over&nbsp;the&nbsp;boundary&nbsp;of&nbsp;the&nbsp;array.

One&nbsp;possible&nbsp;exploit:
/mode&nbsp;nickname&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;i&nbsp;r&nbsp;r&nbsp;r&nbsp;r&nbsp;s

This&nbsp;won't&nbsp;work&nbsp;if&nbsp;there's&nbsp;another&nbsp;NULL&nbsp;directly&nbsp;after&nbsp;the&nbsp;first&nbsp;from&nbsp;the&nbsp;
previous&nbsp;parsed&nbsp;command,&nbsp;if&nbsp;this&nbsp;is&nbsp;the&nbsp;case&nbsp;one&nbsp;can&nbsp;just&nbsp;append&nbsp;more&nbsp;modes&nbsp;
or&nbsp;send&nbsp;some&nbsp;other&nbsp;junk&nbsp;to&nbsp;the&nbsp;ircd.

Resolution
----------

Upgrade&nbsp;to&nbsp;the&nbsp;very&nbsp;latest&nbsp;version&nbsp;of&nbsp;ircu/snircd.

Disclosure&nbsp;timeline
-------------------

2008-03-15:&nbsp;Vulnerability&nbsp;discovered&nbsp;by&nbsp;QuakeNet&nbsp;and&nbsp;reported&nbsp;to&nbsp;Undernet.
2008-03-15:&nbsp;Patches&nbsp;released.
2008-03-17:&nbsp;Patches&nbsp;applied&nbsp;to&nbsp;public&nbsp;servers.
2008-03-24:&nbsp;Public&nbsp;disclosure.

--&nbsp;
Chris&nbsp;Porter&nbsp;(slug&nbsp;on&nbsp;QuakeNet)
http://www.warp13.co.uk

25 Mar 2008 00:00Current

7.1High risk

Vulners AI Score7.1

snircd &lt;= 1.3.4 (send_user_mode) Denial of Service Vulnerability

snircd <= 1.3.4 (send_user_mode) Denial of Service Vulnerability