IRC-Junkie.org - IRC News » Unreal IRCd

Some UnrealIRCd 3.2.8.1 downloads trojaned [Update 3]

phrozen77 — Sat, 12 Jun 2010 10:24:23 +0000

Syzop of the UnrealIRCd project just posted an announcement on their mailinglist and forums that some versions of their IRCd have been compromised and had a backdoor added which went unnoticed for quite a while.

The first signs of the compromise have been traced back to November 2009 and Syzop writes that “Any Unreal3.2.8.1.tar.gz downloaded BEFORE November 10 2009 should be safe, but you should really double-check”.

Only the 3.2.8.1 source downloads (.tar.gz) are affected from this hack. Windows users, copies checked out from their CVS as well as users of older versions are safe and don’t need to check – everyone else should ensure they’re running a clean version of UnrealIRCd since the backdoor allows an attacker to issue and execute commands as the user the IRCd is running as, which essentially means your shell could easily compromised despite all other security measures.

Checking if your IRCd is one of those trojanized copies can easily be done either checking with md5sum or grep’ing the source for the backdoored code:

Run ‘md5sum Unreal3.2.8.1.tar.gz’ on it and compare the resulting sum to the checksums below:

Backdoored version (BAD) is: 752e46f2d873c1679fa99de3f52a274d
Official version (GOOD) is: 7b741e94e867c0a7370553fd01506c66

or use the command ‘grep DEBUG3_DOLOG_SYSTEM include/struct.h’ from your Unreal3.2 directory – if this outputs 2 lines you’re running the trojanized version and need to get yourself a fresh and clean copy of the IRCd and recompile it since the compromised section is in the IRCds core and “it is not possible to ‘clean’ UnrealIRCd without a restart or through a module”.

Syzop writes that they have take precautions so such a compromise can never happen again and if it does that it’ll be noticed more quickly. They’re also planning to reimplement PGP/GPG signing of the releases which “in practice (very) few people use” but “still [will] be useful for those people who do”.

Closing his announcement he writes that he’d like to “apologize about this security breach. We simply did not notice, but should have. We did not check the files on all mirrors regularly, but should have. We did not sign releases through PGP/GPG, but should have done so. Hope you’ll all continue to support UnrealIRCd”.

The full announcement can be read here and the advisory can be found here.

[Update]: Servers running the trojanized versions of UnrealIRCd should be updated as soon as possible since HD Moore, the creator of the Metasploit exploitation framework, already released a module for it – but even without that the security hole is really simple to exploit.

Also, here is a .sh script that might help you in the upgrade process – at least one user on the UnrealIRCd forums claimed it worked for him (although no kind of guarantee is given neither by the author nor by me).

[Update 2]: Syzop just posted a follow-up in which he writes that their releases are “from now on signed with GnuPG (PGP) again”.

[Update 3]: In an email to the UnrealIRCd mailinglist, Syzop elaborates on the GPG/PGP signing and says that there will be instructions on how to verify the key when you download the future releases. He also goes into some detail which precautions the team has taken that such an incident “will never ever happen again”. He rightfully criticizes certain news-outlets that claimed it was the fault of the Open Source model and even Linux (*cough*ZDNet*cough*) – some websites even confused the IRCd with EPIC softwares first-person shooter Unreal Tournament.

Feel free to Flattr this post at flattr.com, if you like it.

Some UnrealIRCd 3.2.8.1 downloads trojaned [Update 3] is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

UnrealIRCd team releases patch against Firefox XPS Attack

phrozen77 — Mon, 01 Mar 2010 15:14:14 +0000

In a posting on the UnrealIRCd project website, coder Syzop announced a module that can help mitigate and completely stop the so-called “Firefox XPS Attack” (NSFW link).

The attack, which exploits the fact that malicious JavaScript can send arbitrary data to a wide range of ports, gained publicity when it was used against the freenode network over a period of a few weeks.

Even though the Mozilla project has a blocklist of ports that are specifically not allowed to be communicated to, the port commonly used by IRC networks (6667) was not on those lists.

The attack – which ironically doesn’t affect Safari, Internet Explorer or Firefox with the NoScript extension – only works if the targeted IRC server does not use anti-spoofing measures before proceeding to the login phase.

UnrealIRCd generally is immune to the threat when it was compiled with the NOSPOOF feature which is enabled by default for the Windows builds but an option that defaults to “no” on Linux (“Do you want to enable the server anti-spoof protection?” – the first question on ./Config).

With the module you can now instantly K/G/Z:Line such connections and therefore prevent them from filling up connection slots which might cause a DoS situation before they eventually time out. For maximum efficiency it is recommended you use both the module and the NOSPOOF option, however one works fine without the other.

To test whether your IRCd is vulnerable or the implemented measures against the attack are effective you can find the code that has been used against freenode here.

Thanks for the tip go to katsklaw!

Feel free to Flattr this post at flattr.com, if you like it.

UnrealIRCd team releases patch against Firefox XPS Attack is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

UnrealIRCd updates their IRCd to 3.2.8.1

phrozen77 — Sun, 26 Apr 2009 13:54:56 +0000

The UnrealIRCd project released a bugfix release of version 3.2.8 and the current release is now 3.2.8.1.

The bugfix became necessary as a crash has been found in the option allow::options::noident.

In a short interview developer nate explains how the crash is being triggered and how to avoid it:

There was an issue in allow::options::noident, where if it was enabled in an allow block that a user could potentially crash a server due to a buffer overflow. As far as we’ve been able to see, there’s no risk of remote code execution as much as it just causing a segfault. The main ways of resolving it are updating to 3.2.8.1 or simply making sure no allow blocks specifically have noident (which most by default won’t thankfully).

It is vulnerable in past versions as well before 3.2.8 as well.

Being asked how far back exactly nate says the exploit exists “at least back towards 3.2.3 (before that we wouldn’t support anyways due to exploits way back then)”.

Thanks for the tip goes to Reed Loden and to nate for taking the time to answer my questions!

Feel free to Flattr this post at flattr.com, if you like it.

UnrealIRCd updates their IRCd to 3.2.8.1 is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

Unreal 3.2.8-rc2 has been released

phrozen77 — Sun, 25 Jan 2009 20:23:03 +0000

A little less than 4 weeks after the -rc1 release, there now is a -rc2 release of UnrealIRCd 3.2.8 available where some of the still present bugs have been fixed.

Fixes in this release include a bug that prevented you from compiling the IRCd on Mac OS X , problems with OperOverride that prevented you from -q/-a’ing someone when you were halfop, an issue with SuSE Linux 10.3 on AMD64 arch where the IRCd core-dumped on start, prevention of throttling client connections and stalling the IRCd when there are big adjustments made to the systems time after starting the IRCd and, last but not least, the documentation has been updated to reflect the latest additions and changes.

The full announcement and changelog can be found here and downloads are available from here.

Feel free to Flattr this post at flattr.com, if you like it.

Unreal 3.2.8-rc2 has been released is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.

UnrealIRCd 3.2.8-rc1 is ready for testing

phrozen77 — Mon, 29 Dec 2008 12:27:10 +0000

And another one in the IRCd updates list – this time it’s Unreal.

After it has been announced that Stskeeps will leave the project behind there has been quite some uproar as it is one of the most widely used IRCd’s today.

The announcement was quickly followed up by nate, who explained that he will indeed continue development on version 3.3.x so the project is far away from being dead but he also noted that “Its still going to be a few months off before any code is here for base uses” as he is “the only one working on 3.3 right now”.

Today Syzop announced the availability of 3.2.8-rc1 which, as he stated in the announcement, “should NOT be used at production servers” but is meant to “allow members from the public to test if there are any major release critical bugs (eg: crash bugs) present, so they can be corrected before the real 3.2.8 release.”

Major Changes, taken from the summary are:

* Zip links issue (Overflowed unzipbuf) * Crash issue with 3rd party modules that introduce new channelmodes w/parameters * Mac OS X: Various issues which prevented the IRCd from booting up * A few rare crash issues, including a crash when linking to another server

Minor fixes include:

* CGI:IRC: Several IPv6 issues, both on IPv6 IRCd's and CGI:IRC gateways * IP masks in oper::from::userhost sometimes didn't match when they should * (G)ZLINE's on IPv6 users were sometimes rejected * CHROOTDIR works again

Notable new features introduced with this release are slow spamfilter detection, where the IRCd checks the time a spamfilter takes to execute each time it is matched and warns about slow executing ones and maybe even disables it if a certain threshold is reached – this will prevent the IRCd from coming to grinding halt if the RegEx is malformed or poorly written.

Away notifications with WATCH opens up the possibility to have Instant Messaging like notifications for users going /away or coming back – although none of the clients currently support this it’s nice to see some innovation in a protocol as old as IRC.

Clients like mIRC, Klient and possibly others can make use of UHNames where the IRCd sends full nick!ident@host masks to be used for the clients internal access list.

Changed behaviour in this release includes the removal of the part reason when someone banned /part’s – this will prevent them from having a last payback for getting banned.

The full changelog can be found in the announcement – downloads are available for Windows, Windows with SSL and as Sourcecode.

Syzop also mentioned that “If you’re willing to help some more, maybe you could help out in the Unreal3.2 testing forum as well, to test specific test-items, be sure to read the first post (‘READ THIS! (how to use)’).”

Happy testing!

Feel free to Flattr this post at flattr.com, if you like it.

UnrealIRCd 3.2.8-rc1 is ready for testing is a post from: IRC-Junkie.org - IRC News

This post is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Deutschland license.