Date: Tue, 29 Jan 2013 17:37:19 +0200 From: Henri Salo <henri@...v.fi> To: oss-security@...ts.openwall.com Cc: moderators@...db.org Subject: ircd-hybrid: Denial of service vulnerability in hostmask.c:try_parse_v4_netmask() Mr. Bob Nomnomnom from Torland reported a denial of service security vulnerability in ircd-hybrid. Function hostmask.c:try_parse_v4_netmask() is using strtoul to parse masks. Documentation says strtoul can parse "-number" as well. Validation of input does not catch evil bits. I can give proof of concept if needed. Fixed in commit: http://svn.ircd-hybrid.org:8000/viewcvs.cgi/ircd-hybrid/trunk/src/hostmask.c?r1=1786&r2=1785&pathrev=1786 Fixed in: ircd-hybrid 8.0.6 I have requested CVE identifier for this vulnerability in another email to Kurt. Other ircds are using the same code. Consider this email as official advisory. I tried to embargo this issue, but the commit is out already. Program received signal SIGSEGV, Segmentation fault. 0x000000000041c799 in try_parse_v4_netmask (text=<value optimized out>, addr=0x113e270, b=0x113e2f8) at hostmask.c:229 229 addb[bits / 8] &= ~((1 << (8 - bits % 8)) - 1); -- Henri Salo
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.