Re: ircd exploit in ircu based code

From: Kev (klmitchat_private)
Date: Thu Jul 15 1999 - 10:39:46 PDT

  • Next message: Claudio Telmon: "Re: Communicator 4.[56]x,"

    > Most irc networks using ircu based servers have a bug that can cause users
    > to segfault the server.
    >
    > In m_join, the code doesn't check to see if get_channel returned failure (by
    > returning NULL).
    
    Which version of ircu?  In 2.10.06, the only pattern that matches your
    patch is wrapped within "if (*mbuf)"; by this time in m_join, the channel
    is known to exist, and we're just sending modes off to the P09 servers.
    (And we're calling sendto_lowprot_butone() instead.)
    
    > While the line numbers will probably be off, this patch will work in most
    > ircu based servers.
    >
    > --- ircd/channel.c	Tue Jul 13 19:58:46 1999
    > +++ ircd/channel.c	Tue Jul 13 20:05:31 1999
    > @@ -2004,6 +2004,12 @@
    >
    >  	  chptr = get_channel (sptr, name, !CREATE);	/* need the TS -Kev */
    >
    > +	  if (!chptr) {
    > +	  	sendto_one (sptr, err_str (ERR_NOSUCHCHANNEL),
    > +	  		    me.name, parv[0], name);
    > +	  	return(0);
    > +	  }
    > +	
    >  	  sendto_serv_butone (cptr, ":%s MODE %s +%s%s %lu", me.name, name,
    >  			      sendmode ? "o " : "", sendmode ? parv[0] : "",
    >  			      chptr->creationtime);	/* send the MODE to the
    
    Judging from context (it's been a long time since I wrote this code), this
    is the same place as I indicate above, and we already know for a fact that
    the channel exists.  Perhaps an assertion should go in there...
    
    Also note that your return is misplaced; this is inside a loop, and you
    are terminating the loop prematurely.  You can easily end up with a desync,
    when what should happen is the server should die, because it's lost a
    channel while trying to add someone to it!
    --
    Kevin L. Mitchell <klmitchat_private>
    -------------------------  -. .---- --.. ..- -..-  --------------------------
    http://web.mit.edu/klmitch/www/               (PGP keys availiable from here)
        RSA AE87D37D/1024:  DE EA 1E 99 3F 2B F9 23  A0 D8 05 E0 6F BA B9 D2
        DSS ED0DB34E/1024: D9BF 0E74 FDCB 43F5 C597  878F 9455 EC24 ED0D B34E
        DH  2A2C31D4/2048: 1A77 4BA5 9E32 14AE 87DA  9FEC 7106 FC62 2A2C 31D4
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:52:26 PDT