View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001396 | unreal | ircd | public | 2003-11-29 00:55 | 2003-11-29 19:11 |
| Reporter | _Iww_ | Assigned To | |||
| Priority | normal | Severity | crash | Reproducibility | always |
| Status | closed | Resolution | open | ||
| Product Version | 3.2-beta17 | ||||
| Summary | 0001396: The Daemon crashes becoming bad command | ||||
| Description | UnrealIRCd is crashing, when one Server, linked to it sends "SJOIN" command. Was found by mistyping command "SAJOIN" | ||||
| 3rd party modules | |||||
|
|
1. You are 2 version behind 2. Do you mean you did a bad raw command (like home-made services or /msg operserv raw ...)? Or was it unreal crashing another unreal server. |
|
|
Today I have tryed do to the same thing with beta-19. It works in the same way. I'm crashing the server just with telnet: last# telnet localhost 8000 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. :irc.test.com NOTICE AUTH :*** Looking up your hostname... :irc.test.com NOTICE AUTH :*** Found your hostname PASS test SERVER irc.evil.com 2 bla-bla <some info omitted> SJOIN a #a Connection closed by foreign host. ---- So, every Admin (but not only admins), who has linked a server to the network can crash the hub and nobody will know who has made it. I think, the funktion for SJOIN-Command must better check the parameters. The Server crashes if the first argument is a valid nickname and the second - valid channel name. This error was originally found by Fixxxer from IwwNet, while working with Unreal as a linked server, through telnet. |
|
|
This won't be fixed. Perhaps we should add a FAQ entry for that: Servers are strusted, the commands are not (fully) checked for various reasons: mainly speed & lazyness. So again, we will NOT fix these type of bugs, they have been reported before but it's just not worth it! (speed & time involved to do it and after all giving a false sense of "security"). A few references: http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2003-07/0068.html http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2003-07/0074.html As you can see services coders fully agree with us. |
