Multiple ircd Socket Dequeuing Denial of Service Vulnerability

Bugtraq ID:	10572
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2004-0605
Remote:	Yes
Local:	No
Published:	Jun 19 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	Discovery is credited to Erik Sperling Johansen <[email protected]>.
Vulnerable:	ircd-ratbox ircd-ratbox 2.0 rc6 ircd-ratbox ircd-ratbox 1.5.1 IRCD-Hybrid Ircd-Hybrid 7.0.1
Not Vulnerable:	ircd-ratbox ircd-ratbox 2.0 rc7 ircd-ratbox ircd-ratbox 1.5.2 IRCD-Hybrid Ircd-Hybrid 7.1 devel IRCD-Hybrid Ircd-Hybrid 6.0

Multiple ircd Socket Dequeuing Denial of Service Vulnerability

A denial of service vulnerability exists in multiple ircd implementations. This exists because of an issue with the deallocation of buffers used by rate limiting mecahnisms in the ircd. This could result in exhaustion of memory resources on the system running the ircd.

This issue was reported to exist in ircd-hybrid version 7.0.1 and earlier, ircd-ratbox 1.5.1 and earlier, and ircd-ratbox 2.0rc6 and earlier.

Multiple ircd Socket Dequeuing Denial of Service Vulnerability

The following exploit was provided:

• /data/vulnerabilities/exploits/h7kill.c

Multiple ircd Socket Dequeuing Denial of Service Vulnerability

Solution:
Fixes are available:


ircd-ratbox ircd-ratbox 1.5.1

• ircd-ratbox ircd-ratbox 1.5.2
  http://www.ircd-ratbox.org/download.shtml

IRCD-Hybrid Ircd-Hybrid 7.0.1

• IRCD-Hybrid unreg_limit.diff
  http://www.ircd-hybrid.org/diff/unreg_limit.diff

Multiple ircd Socket Dequeuing Denial of Service Vulnerability

References:

• IRCD-Hybrid Home Page (IRCD-Hybrid)
  
• ircd-ratbox Home Page (ircd-ratbox)
  
• ircd-hybrid-7 / ircd-ratbox low-bandwidth DoS (Erik Sperling Johansen )