View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000856 | unreal | ircd | public | 2003-03-30 17:45 | 2003-11-20 19:46 |
| Reporter | Wombling Pikachu | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | no change required | ||
| Product Version | 3.2-beta15 | ||||
| Summary | 0000856: Fake Usermode Bug with raw 221 | ||||
| Description | When a remote server sends a raw 221 to a user, i.e.: /os raw 221 <user> :<value>, the client interprets <value> as new usermodes(though the server does not). This opens up some rather annoying possibilities, as well as some rare but very possible abuse options. | ||||
| Steps To Reproduce | 1. Connect a services server with raw abilities. 2. Type /os raw 221 <user> :<any value> My test involved <user> using a mIRC client, I am unaware if this works in other clients, but very well may. | ||||
| Additional Information | A probable fix would just be parsing server input for a raw 221, and halting it then and there. I can think of no need for a remote 221, so no additional checking should be needed. | ||||
| 3rd party modules | |||||
|
|
Thats not even close to a bug. If your services admins are stupid enough to do that, then they shouldn't have raw access. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2003-11-20 19:46 | syzop | Status | resolved => closed |
