oss-security - CVE Request: inspircd

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [thread-next>] [month] [year] [list]

Date:  Tue, 22 Apr 2008 16:57:04 -0400
From:  Micah Anderson <micah@...eup.net>
To: oss-security@...ts.openwall.com
Subject:  CVE Request: inspircd

Versions prior to 1.1.17 of InspIRCd are vulnerable to a remotely
triggerable buffer overflow which can lead to a Denial of Service
(daemon crash) when the namesx and uhnames modules are loaded. 

InspIRCd is a modular C++ IRCd (IRC daemon) for Linux, BSD, Windows and
Apple OS X systems created to provide a stable, modern, and lightweight
IRCd written from scratch.

Reference: http://inspircd.org/forum/showthread.php?t=2945

How the issue can be triggered:

if you load both the namesx and uhnames modules, then set your nicklen
to 31 characters and your ident len is 12 and and your channel len is
64, then you can crash the ircd by joining a lot of users to a channel
with 31 char nicks, 12 char idents and very long hostnames, and then
joining a single final user to the channel who has uhnames

workaround: unload uhnames or upgrade to 1.1.17

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.