bugtraq - Re: Eggrop bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <40285C07.6080806@techmonkeys.org>
Date: Mon, 09 Feb 2004 22:20:23 -0600
From: Jeff Fisher <guppy@...hmonkeys.org>
To: "cyborgirl@...ero.it" <cyborgirl@...ero.it>
Cc: bugtraq <bugtraq@...urityfocus.com>, eggdev@...heads.org
Subject: Re: Eggrop bug

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

| Issue Details:
| ==============
| share.mod use tandem buffers to handle userfile resync transfers.
tandem buffers
| are checked
| minutely by check_expired_tbufs() in order to flush tandem buffers
older than 15
| minutes
| (resync_time). check_expired_tbufs() accomplish also to handle
userfile requests
| in limbo
| (that haven't received yet any response from tandem bot). While doing
those
| checks the
| programmer has left out some parentheses and the worst has happened:
| Here the incriminated snip:

Thankfully resync sharing is considered broken and most people do not
use it. Indeed though, this is a bug and thank you for finding it.

| --- eggdrop1.6.15/src/mod/share.mod/share.c	Sat Feb  7 05:13:32 2004
| +++ eggdrop1.6.15-sp/src/mod/share.mod/share.c	Sat Feb  7 05:43:33 2004
| @@ -1457,9 +1457,11 @@
|            /* ^ send it again in case they missed it */
|          /* If it's a share bot that hasnt been sharing, ask again */
|        } else if (!(dcc[i].status & STAT_SHARE)) {
| -        if (dcc[i].user && (bot_flags(dcc[i].user) & BOT_AGGRESSIVE))
| +	/* Patched from original source by giusc@...s.it <20040207> */
| +        if (dcc[i].user && (bot_flags(dcc[i].user) & BOT_AGGRESSIVE))  {
|            dprintf(i, "s u?\n");
| -        dcc[i].status |= STAT_OFFERED;
| +          dcc[i].status |= STAT_OFFERED;
| +        }
|        }
|      }
|  }
|

This patch has been applied to the latest CVS copy with the correct credits.

| Vendor status:
| ===============
| Notified on 07 February 2004
|

Where did you notify eggheads? I seem to be blind while looking for it.

Jeff

- --
Jeff Fisher <guppy@...heads.org>
Eggdrop Development Team
Eggheads.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAKFwHGi4Ni4h3f1YRAkoGAJ9FUHyPMhXW2z9/EU/+3gm9ac4O8gCgh0Ld
pghogz/K0O2at7ODk8JVOnM=
=yyRM
-----END PGP SIGNATURE-----