software/RELEASES/ircservices/achurch.org/services/lists/ircservices/2003/003533.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
   2 <HTML>
   3  <HEAD>
   4    <TITLE> [IRCServices] Possible bug
   5    </TITLE>
   6    <LINK REL="Index" HREF="index.html" >
   7    <LINK REL="made" HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Possible%20bug&In-Reply-To=5.1.0.14.2.20030201013224.00b846c8%40mail.telvia.it">
   8    <META NAME="robots" CONTENT="index,nofollow">
   9    <META http-equiv="Content-Type" content="text/html; charset=us-ascii">
  10    <LINK REL="Previous"  HREF="003532.html">
  11    <LINK REL="Next"  HREF="003931.html">
  12  </HEAD>
  13  <BODY BGCOLOR="#ffffff">
  14    <H1>[IRCServices] Possible bug</H1>
  15     <B>Andrew Church</B>
  16     <A HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Possible%20bug&In-Reply-To=5.1.0.14.2.20030201013224.00b846c8%40mail.telvia.it"
  17        TITLE="[IRCServices] Possible bug">achurch at achurch.org
  18        </A><BR>
  19     <I>Sat Feb  1 10:25:38 PST 2003</I>
  20     <P><UL>
  21         <LI>Previous message: <A HREF="003532.html">[IRCServices] Possible bug
  22 </A></li>
  23         <LI>Next message: <A HREF="003931.html">[IRCServices] Possible bug
  24 </A></li>
  25          <LI> <B>Messages sorted by:</B>
  26               <a href="date.html#3533">[ date ]</a>
  27               <a href="thread.html#3533">[ thread ]</a>
  28               <a href="subject.html#3533">[ subject ]</a>
  29               <a href="author.html#3533">[ author ]</a>
  30          </LI>
  31        </UL>
  32     <HR>
  33 <!--beginarticle-->
  34 <PRE>     I don't see how this could be &quot;exploited&quot; in the ordinary sense of the
  35 word, but it can lead to desynchs.  Thanks for pointing the problem out.
  36
  37   --Andrew Church
  38     <A HREF="http://www.ircservices.za.net/mailman/listinfo/ircservices">achurch at achurch.org</A>
  39     <A HREF="http://achurch.org/">http://achurch.org/</A>
  40
  41 &gt;<i>You may want to take a look at the
  42 </I>&gt;<i>split_buf() function in process.c, I believe
  43 </I>&gt;<i>that there is a bug in how the argv[]'s are
  44 </I>&gt;<i>filled that might be exploited easily on some
  45 </I>&gt;<i>boxes.
  46 </I>&gt;<i>
  47 </I>&gt;<i>Depending on what the isspace() function
  48 </I>&gt;<i>considers as space (usually 7-8 characters,
  49 </I>&gt;<i>including line feeds, tabs, and the like,
  50 </I>&gt;<i>and not just the actual space character),
  51 </I>&gt;<i>when you strpbrk() the buffer looking for
  52 </I>&gt;<i>an actual space, if the result is composed
  53 </I>&gt;<i>only of those other characters considered
  54 </I>&gt;<i>spaces by the isspace() function, the whole
  55 </I>&gt;<i>string will be skipped, and bad things can
  56 </I>&gt;<i>happen.
  57 </I>&gt;<i>
  58 </I>&gt;<i>This is easily exploitable with, say, a
  59 </I>&gt;<i>//mode #channel +k $chr(9)
  60 </I>&gt;<i>in mIRC.
  61 </I>&gt;<i>
  62 </I>&gt;<i>I hope I'm wrong about this... :)
  63 </I>&gt;<i>
  64 </I>&gt;<i>--
  65 </I>&gt;<i>Gastaman @ irc.azzurra.org || irc.dal.net
  66 </I>&gt;<i>
  67 </I>&gt;<i>Fan di Adachi - <A HREF="http://www.adachi.it">http://www.adachi.it</A>
  68 </I>&gt;<i>Moderatore di IAFM - it.arti.fumetti.manga
  69 </I>&gt;<i>
  70 </I>&gt;<i>
  71 </I>&gt;<i>------------------------------------------------------------------
  72 </I>&gt;<i>To unsubscribe or change your subscription options, visit:
  73 </I>&gt;<i><A HREF="http://www.ircservices.za.net/mailman/listinfo/ircservices">http://www.ircservices.za.net/mailman/listinfo/ircservices</A>
  74 </I></PRE>
  75
  76 <!--endarticle-->
  77     <HR>
  78     <P><UL>
  79         <!--threads-->
  80         <LI>Previous message: <A HREF="003532.html">[IRCServices] Possible bug
  81 </A></li>
  82         <LI>Next message: <A HREF="003931.html">[IRCServices] Possible bug
  83 </A></li>
  84          <LI> <B>Messages sorted by:</B>
  85               <a href="date.html#3533">[ date ]</a>
  86               <a href="thread.html#3533">[ thread ]</a>
  87               <a href="subject.html#3533">[ subject ]</a>
  88               <a href="author.html#3533">[ author ]</a>
  89          </LI>
  90        </UL>
  91
  92 </body></html>