880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
60 lines
No EOL
1.9 KiB
Text
60 lines
No EOL
1.9 KiB
Text
eggdrop/windrop remote crash vulnerability
|
|
|
|
* This message: [ Message body ] [ More options ]
|
|
* Related messages: [ Next message ] [ Previous message ] [ Next in thread ] [ Replies ]
|
|
|
|
From: Thomas Sader <thommey_at_gmail.com>
|
|
Date: Fri, 15 May 2009 05:54:08 +0200
|
|
|
|
Affected software
|
|
-----------------
|
|
|
|
eggdrop (1.6.19 only, not 1.6.19+ctcpfix)
|
|
windrop (1.6.19 only, not 1.6.19+ctcpfix)
|
|
all eggdrop/windrop versions and packages which apply Nico Goldes
|
|
patch for CVE-2007-2807/SA25276 See: [1]
|
|
|
|
Vulnerability details
|
|
---------------------
|
|
|
|
The SA25276 patch ([1]) uses strncpy to fix a buffer overflow vulnerability
|
|
in src/mod/server.mod/servmsg.c (gotmsg). The last argument is not checked
|
|
for being non-negative, but that can happen if ctcpbuf is "". That causes
|
|
a remote crash vulnerability to be exploited by anyone connected to the same
|
|
IRC network as eggdrop. The SA25276 patch has been applied to the eggdrop1.6.18
|
|
debian package and was later adopted by Eggheads into eggdrop1.6.19.
|
|
|
|
One possible exploit anyone can send to the IRC server to crash eggdrop:
|
|
|
|
PRIVMSG eggdrop :\1\1
|
|
|
|
Resolution
|
|
----------
|
|
|
|
Upgrade to eggdrop/windrop 1.6.19+ctcpfix ([2],[3]), the current cvs versions,
|
|
or apply the ctcpfix patch at [2] before compiling.
|
|
|
|
Disclosure timeline
|
|
-------------------
|
|
|
|
2009-05-06: Vulnerability discovered and reported to Eggheads.
|
|
2009-05-06: Patch committed to cvs.
|
|
2009-05-14: New eggdrop and windrop version released with the fix applied.
|
|
2009-05-14: Public disclosure.
|
|
|
|
References
|
|
----------
|
|
|
|
[1] http://bugzilla.eggheads.org/show_bug.cgi?id=462
|
|
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=427157
|
|
https://www.securityfocus.com/bid/24070
|
|
http://secunia.com/advisories/25276
|
|
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2807
|
|
|
|
[2] http://www.eggheads.org/downloads/
|
|
[3] http://windrop.sourceforge.net/downloads.html
|
|
|
|
---
|
|
Thomas Sader (thommey)
|
|
|
|
# milw0rm.com [2009-05-15] |