OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: J. S. Connell (ankh_at_canuck.gen.nz)
Date: Thu Aug 22 2002 - 14:06:50 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    -----BEGIN PGP SIGNED MESSAGE-----

    SUMMARY
    - -------

    All versions of Light prior to 2.7.30p5 (on the 2.7 branch) or 2.8pre10 (on
    the 2.8 branch) running under any version of EPIC4 on any platform are
    vulnerable to a remotely-exploitable bug that can execute nearly-arbitrary
    code. All Light users are very strongly urged to upgrade to stable release
    2.7.30p5 or beta 2.8pre10 immediately. See below for URLs, MD5 hashes, and
    other information.

    DETAIL
    - ------

    I've recently discovered that the IRC script for EPIC4 that I maintain is
    vulnerable to a fairly easy remote attack. If a malicious user can convince
    a user to join a channel whose name contains embedded EPIC4 script, several
    different code paths inside Light will cause that script to be executed.

    The attack is mollified by four factors:

    1. A user has to be incautious enough to join a channel with embedded code.

    2. The embedded code is limited to expanding variables and calling EPIC
    built-in functions and user-defined aliases and functions -- built-in
    commands cannot be executed.

    3. Light does not contain any features for automatically joining channels.
    However, it should be pointed out that auto-join-on-invite can be achieved
    by simply adding 'on invite * join $1' to one's .ircrc.

    4. An unmodified copy of Light will not permit you to run it as root,
    slightly limiting potential damage. Yes, you *are* an idiot if you IRC as
    root, and this advisory should demonstrate why!

    One might be tempted to add a fifth factor -- that channel names cannot
    contain spaces -- but EPIC provides built-in functions that provide a
    space-free and opaque (to the naked eye) 'transport armour'.

    It should also be noted that EPIC4 with *no* scripts loaded is also
    vulnerable to this attack, but *only* if the STATUS_DOES_EXPANDOS setting
    is changed from its default to ON. (STATUS_DOES_EXPANDOS is, to my mind,
    an inherently dangerous feature with valid, but rare, uses. Its existence
    typifies the UNIX philosophy: "Here's the gun, the ammo, and the sights,
    and if you blow your foot off with them, don't come crying to me.")

    Because other IRC scripts may well be vulnerable to this attack or to
    other, similar attacks, I do not wish to provide examples of how to exploit
    this, although it should be obvious to anyone familiar with EPIC4
    scripting.

    FIXED VERSIONS
    - --------------

    Light 2.7.30p5 and Light 2.8pre10 have been released, which resolve this
    issue. The tarballs are available for download from:

       ftp://ftp.light.canuck.gen.nz/pub/Light/

    Updated Debian packages will also available shortly. To the best of my
    knowledge, Light is not distributed by any other vendors.

    You can find me on IRC as Liandrin, on Undernet in #epic+light, or on EFnet
    in #epic.

    MD5sums:

       6dffeddbb059a145dba2694fd2d04d6e Light-2.7.30p5.tar.bz2
       28c6f204e92dd6a1f89724e9e7af80e1 Light-2.7.30p5.tar.bz2.asc

       4a815f15c522e016a39c42fc96cb33ad Light-2.7.30p5.tar.gz
       570dde757ed65a2b133f24c3406a9399 Light-2.7.30p5.tar.gz.asc

       6f201aa5c2fc729766a5b11840bf07a5 Light-2.8pre10.tar.bz2
       2d463273545694ef9862a90d3acbbe1c Light-2.8pre10.tar.bz2.asc

       c1dde9996bb63be29cc1cfcd56479675 Light-2.8pre10.tar.gz
       c56873d39d67243f19874c3c21bff0b2 Light-2.8pre10.tar.gz.asc

    (Note to Macintosh and Windows users: the .asc files must be transferred in
    BINARY mode for the md5sum to compute correctly. Users of Cygwin's md5sum
    command should use the -b (binary mode) flag.)

    -----BEGIN PGP SIGNATURE-----
    Version: PGPfreeware 5.0i for non-commercial use
    Charset: noconv

    iQCVAwUBPWU2YbDeqAwrixFtAQE8AgP/a4azithVEhuR+atf71TfImSl0l90sFT2
    dDQAPO1P2f7/4jxUxhaaBZ+fG4eTeFEGzeUYJiY+ZbssjaYjAiAmKmIsDD6wA4w9
    PJQSlreC4En8VhD9/sSEsaRsTnU4QMNJQrZpD6QeVb9ILd5zYqVn40XAQDRcS9wb
    ho0y6W1JU+8=
    =zTTa
    -----END PGP SIGNATURE-----