Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: ircd exploit in ircu based code
From: klmitch () MIT EDU (Kev)
Date: Thu, 15 Jul 1999 13:39:46 EDT


Most irc networks using ircu based servers have a bug that can cause users
to segfault the server.

In m_join, the code doesn't check to see if get_channel returned failure (by
returning NULL).

Which version of ircu?  In 2.10.06, the only pattern that matches your
patch is wrapped within "if (*mbuf)"; by this time in m_join, the channel
is known to exist, and we're just sending modes off to the P09 servers.
(And we're calling sendto_lowprot_butone() instead.)

While the line numbers will probably be off, this patch will work in most
ircu based servers.

--- ircd/channel.c    Tue Jul 13 19:58:46 1999
+++ ircd/channel.c    Tue Jul 13 20:05:31 1999
@@ -2004,6 +2004,12 @@

        chptr = get_channel (sptr, name, !CREATE);    /* need the TS -Kev */

+       if (!chptr) {
+             sendto_one (sptr, err_str (ERR_NOSUCHCHANNEL),
+                         me.name, parv[0], name);
+             return(0);
+       }
+     
        sendto_serv_butone (cptr, ":%s MODE %s +%s%s %lu", me.name, name,
                            sendmode ? "o " : "", sendmode ? parv[0] : "",
                            chptr->creationtime);     /* send the MODE to the

Judging from context (it's been a long time since I wrote this code), this
is the same place as I indicate above, and we already know for a fact that
the channel exists.  Perhaps an assertion should go in there...

Also note that your return is misplaced; this is inside a loop, and you
are terminating the loop prematurely.  You can easily end up with a desync,
when what should happen is the server should die, because it's lost a
channel while trying to add someone to it!

--
Kevin L. Mitchell <klmitch () mit edu>
-------------------------  -. .---- --.. ..- -..-  --------------------------
http://web.mit.edu/klmitch/www/               (PGP keys availiable from here)
    RSA AE87D37D/1024:  DE EA 1E 99 3F 2B F9 23  A0 D8 05 E0 6F BA B9 D2
    DSS ED0DB34E/1024: D9BF 0E74 FDCB 43F5 C597  878F 9455 EC24 ED0D B34E
    DH  2A2C31D4/2048: 1A77 4BA5 9E32 14AE 87DA  9FEC 7106 FC62 2A2C 31D4



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]