IRCu Family IRCd DoS Exploit

Hello there! If you are new here, you might want to subscribe to the RSS feed for more & updated news about the world of IRC.

You're also welcome to follow us on Twitter or join our Facebook Fanpage.

If you liked this post, please show your support by clicking on our flattr button - thank you! :)

Last month a new bug have been found in IRCu family IRCd’s which can be exploited leading to a crashing server.

In this post on Milw0rm the bug and exploit is explained. IRCu (<= 2.10.12.12) and many derivatives are affected.

IRC-Junkie asked Slug, who found the bug and described it on Milw0rm, how he found the bug. “Core dump from one of our servers,” Slug starts. “send_user_mode in s_user.c does not check that the argument after a +r mode is present, if it is not than the NULL sentinel may be missed, causing the function to iterate over the boundary of the array.”

One way to exploit the bug would be using the command with string /mode nickname i i i i i i i i i i i i i i i r r r r s. Doing so would core the server.

Only cure is to upgrade to the latest version of the IRCd with fix for this exploit.

GameSurge tests new IPv6 code in ircu "Our development committee is currently testing our new IPv6 IRC...
XChat Author Warns for Firefox Exploit A second more serious security issue has been discovered which...
freenode testing a new IRCd freenode, the network hosting the channels for many free /...
mIRC Local DCC Issue: Exploit, Vulnerability or Neither? mIRC has seen issues with DCC exploits in the past....
UnrealIRCd updates their IRCd to 3.2.8.1 The UnrealIRCd project released a bugfix release of version 3.2.8...

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/digg_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/reddit_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/dzone_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/stumbleupon_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/delicious_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/blinklist_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/blogmarks_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/newsvine_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/technorati_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/google_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/myspace_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/facebook_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/yahoobuzz_48.png

http://www.irc-junkie.org/wp-content/plugins/sociofluid/images/twitter_48.png

Tags: Hack, IRC, IRCu

This entry was posted on Wednesday, April 9th, 2008 at 10:46 pm and is filed under Hack, IRC, IRCd. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

2 Responses to “IRCu Family IRCd DoS Exploit”

El_Rico Says:
October 29th, 2008 at 1:31 pm Quote
I am not too sure that it was a wise idea that slug posted such an easy way to exploit it.
Asmo Says:
October 29th, 2008 at 1:31 pm Quote
Even if it was ‘hard’ to exploit enough people would be able to exploit. As long as enough time has been given to the users to upgrade…

IRC-Junkie.org – IRC News

IRCu Family IRCd DoS Exploit

2 Responses to “IRCu Family IRCd DoS Exploit”

Leave a Reply