bugtraq - Quassel IRC: connection hijacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 29 Oct 2008 00:26:57 +0100
From: Wouter Coekaerts <wouter@...kaerts.be>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Quassel IRC: connection hijacking

Quassel IRC (http://quassel-irc.org/) is "a modern, cross-platform, 
distributed IRC client".
A vulnerability in the CTCP handling allows an attacker to trick Quassel IRC 
into sending arbitrary commands to the IRC server.
This can be used by an attacker for example to gain operator privileges on a 
channel.

Details
=======
A CTCP ping where the value contains a CTCP quoted newline ('\020' + 'n') will 
let the Quassel core reply with a message containing an unquoted newline 
('\n'). The IRC server interprets this as a command separator.

Solution
========
This has been fixed in version 0.3.0.2, released Oct 27 2008.

Online version: http://wouter.coekaerts.be/site/security/quassel-ctcp