ircu/snircd NULL sentinel vulnerability

vendor:

ircu/snircd

by:

Chris Porter

7.5

CVSS

HIGH

NULL sentinel vulnerability

787

CWE

Product Name: ircu/snircd

Affected Version From: ircu (upto and including 2.10.12.12)

Affected Version To: snircd (upto and including 1.3.4)

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

ircu/snircd NULL sentinel vulnerability

send_user_mode in s_user.c does not check that the argument after a +r mode is present, if it is not than the NULL sentinel may be missed, causing the function to iterate over the boundary of the array. One possible exploit: /mode nickname i i i i i i i i i i i i i i i r r r r s

Mitigation:

Upgrade to the very latest version of ircu/snircd.

Source

Exploit-DB raw data:

Affected software
-----------------

ircu (upto and including 2.10.12.12)
snircd (upto and including 1.3.4)
and many other ircu derivatives

Vulnerability details
---------------------

send_user_mode in s_user.c does not check that the argument after a +r mode 
is present, if it is not than the NULL sentinel may be missed, causing the 
function to iterate over the boundary of the array.

One possible exploit:
/mode nickname i i i i i i i i i i i i i i i r r r r s

This won't work if there's another NULL directly after the first from the 
previous parsed command, if this is the case one can just append more modes 
or send some other junk to the ircd.

Resolution
----------

Upgrade to the very latest version of ircu/snircd.

Disclosure timeline
-------------------

2008-03-15: Vulnerability discovered by QuakeNet and reported to Undernet.
2008-03-15: Patches released.
2008-03-17: Patches applied to public servers.
2008-03-24: Public disclosure.

-- 
Chris Porter (slug on QuakeNet)
http://www.warp13.co.uk

# milw0rm.com [2008-03-24]