Unreal IRCD Cloak.C IP Address Disclosure Vulnerability

Bugtraq ID:	10663
Class:	Design Error
CVE:	CVE-2004-0679
Remote:	Yes
Local:	No
Published:	Jul 05 2004 12:00AM
Updated:	Jul 12 2009 06:16AM
Credit:	Discovery is credited to bartavelle <[email protected]>.
Vulnerable:	Unreal UnrealIRCd 3.2 .0 beta 10 Unreal UnrealIRCd 3.2 Unreal UnrealIRCd 3.1.3 Unreal UnrealIRCd 3.1.1
Not Vulnerable:	Unreal UnrealIRCd 3.2.1

Unreal IRCD Cloak.C IP Address Disclosure Vulnerability

Unreal ircd is reported prone to a vulnerability that may allow a remote attacker to disclose a user's IP address when the IP cloaking feature is used to obfuscate the IP address. It is reported that due to a weakness in the algorithm used to cloak IP addresses in the 'cloak.c' file, an attacker can disclose a user's IP address.

Successful exploitation of this issue will reveal the IP address of a vulnerable user and the attacker can then carry out other attacks against the computer.

Unreal IRCD Cloak.C IP Address Disclosure Vulnerability

The researchers who discovered this vulnerability have developed exploit code to carry out this attack. This exploit has not been released to public.

Unreal IRCD Cloak.C IP Address Disclosure Vulnerability

Solution:
Unreal ircd 3.2.1 is available to address this issue.


Unreal UnrealIRCd 3.1.1

• Unreal IRCD 3.2.1
  http://www.unrealircd.com/?page=downloads

Unreal UnrealIRCd 3.1.3

• Unreal IRCD 3.2.1
  http://www.unrealircd.com/?page=downloads

Unreal UnrealIRCd 3.2 .0 beta 10

• Unreal IRCD 3.2.1
  http://www.unrealircd.com/?page=downloads

Unreal UnrealIRCd 3.2

• Unreal IRCD 3.2.1
  http://www.unrealircd.com/?page=downloads

Unreal IRCD Cloak.C IP Address Disclosure Vulnerability

References:

• UnrealIRCd Homepage (Unreal)
  
• unreal ircd ip cloaking subsystem vulnerability (bartavelle )