muh IRC日志格式化字符串漏洞

漏洞信息详情

muh IRC日志格式化字符串漏洞

• CNNVD编号：CNNVD-200011-063
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2000-0857
  
• 漏洞类型：
  
  
  格式化字符串
  
• 发布时间：
  
  2000-11-14
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-10-20
  
• 厂        商：
  
  sebastian_kienzl
• 漏洞来源：
  Discussed in a mes…

muh 2.05d IRC server的登录功能不正确清除user-injected格式化字符串，远程攻击者可以借助畸形昵称导致服务拒绝或执行任意命令。

Patch (from a BugTraq message by Kris Kennaway ):
— src/muh.c.orig Sun Mar 19 04:08:27 2000
+++ src/muh.c Sat Sep 9 21:32:15 2000
@@ -575,7 +575,7 @@
if( strcmp( param2 + 2, “USERINFO\1” ) == 0 )
irc_notice( &c_server, nick, USERINFOREPLY );
if( strncmp( param2 + 2, “PING”, 4 ) == 0 ) {
– if( strlen( param2 + 1 ) > 6 ) irc_notice( &c_server, nick, param2 + 1 );
+ if( strlen( param2 + 1 ) > 6 ) irc_notice( &c_server, nick, “%s”, param2 + 1 );
}
if( strcmp( param2 + 2, “CLIENTINFO\1” ) == 0 )
irc_notice( &c_server, nick, CLIENTINFOREPLY );
@@ -591,7 +591,7 @@
}
else { /* normale message/notice */
if( !is_ignore( hostname, IGNORE_MESSAGE ) && status.allowreply ) {
– if( cfg.awaynotice ) irc_notice( &c_server, nick, cfg.awaynotice );
+ if( cfg.awaynotice ) irc_notice( &c_server, nick, “%s”, cfg.awaynotice );
add_ignore( hostname, 120, IGNORE_MESSAGE );
status.allowreply = 0;
timers.reply = 0;
@@ -841,7 +841,7 @@
s = ( char * )malloc( 1024 );
while( fgets( s, 1023, messagelog ) ) {
if( s[ strlen( s ) – 1 ] == ‘\n’ ) s[ strlen( s ) – 1 ] = 0;
– irc_notice( &c_client, status.nickname, s );
+ irc_notice( &c_client, status.nickname, “%s”, s );
}
FREESTRING( s );
Vendor-Supplied Patch:
The vendor is aware of the vulnerability as of September 11, 2000.
According to the vendor’s web page <
http://mind.riot.org/muh/>, a patch will be released soon.
FreeBSD:
See advisory FreeBSD-SA-00:57 listed in Credit section.
Sebastian Kienzl muh 2.0 5d
@freebsd.org>

• Kris Kennaway muh.patchPatch against muh.c
  
  http://www.securityfocus.com/data/vulnerabilities/patches/muh.patch@freebsd.org>

来源: BID
名称: 1665
链接:http://www.securityfocus.com/bid/1665

来源: XF
名称: muh-log-dos
链接:http://xforce.iss.net/static/5215.php

来源: BUGTRAQ
名称: 20000909 Re: format string bug in muh
链接:http://archives.neohapsis.com/archives/bugtraq/2000-09/0068.html

来源: BUGTRAQ
名称: 20000909 format string bug in muh
链接:http://archives.neohapsis.com/archives/bugtraq/2000-09/0067.html