Light Security Advisory: Remotely-exploitable code execution
Date: Thu, 22 Aug 2002 12:06:50 -0700 (PDT)
From: "J. S. Connell" <ankh@canuck.gen.nz>
To: bugtraq@securityfocus.com
Subject: Light Security Advisory: Remotely-exploitable code execution
-----BEGIN PGP SIGNED MESSAGE-----
SUMMARY
- -------
All versions of Light prior to 2.7.30p5 (on the 2.7 branch) or 2.8pre10 (on
the 2.8 branch) running under any version of EPIC4 on any platform are
vulnerable to a remotely-exploitable bug that can execute nearly-arbitrary
code. All Light users are very strongly urged to upgrade to stable release
2.7.30p5 or beta 2.8pre10 immediately. See below for URLs, MD5 hashes, and
other information.
DETAIL
- ------
I've recently discovered that the IRC script for EPIC4 that I maintain is
vulnerable to a fairly easy remote attack. If a malicious user can convince
a user to join a channel whose name contains embedded EPIC4 script, several
different code paths inside Light will cause that script to be executed.
The attack is mollified by four factors:
1. A user has to be incautious enough to join a channel with embedded code.
2. The embedded code is limited to expanding variables and calling EPIC
built-in functions and user-defined aliases and functions -- built-in
commands cannot be executed.
3. Light does not contain any features for automatically joining channels.
However, it should be pointed out that auto-join-on-invite can be achieved
by simply adding 'on invite * join $1' to one's .ircrc.
4. An unmodified copy of Light will not permit you to run it as root,
slightly limiting potential damage. Yes, you *are* an idiot if you IRC as
root, and this advisory should demonstrate why!
One might be tempted to add a fifth factor -- that channel names cannot
contain spaces -- but EPIC provides built-in functions that provide a
space-free and opaque (to the naked eye) 'transport armour'.
It should also be noted that EPIC4 with *no* scripts loaded is also
vulnerable to this attack, but *only* if the STATUS_DOES_EXPANDOS setting
is changed from its default to ON. (STATUS_DOES_EXPANDOS is, to my mind,
an inherently dangerous feature with valid, but rare, uses. Its existence
typifies the UNIX philosophy: "Here's the gun, the ammo, and the sights,
and if you blow your foot off with them, don't come crying to me.")
Because other IRC scripts may well be vulnerable to this attack or to
other, similar attacks, I do not wish to provide examples of how to exploit
this, although it should be obvious to anyone familiar with EPIC4
scripting.
FIXED VERSIONS
- --------------
Light 2.7.30p5 and Light 2.8pre10 have been released, which resolve this
issue. The tarballs are available for download from:
ftp://ftp.light.canuck.gen.nz/pub/Light/
Updated Debian packages will also available shortly. To the best of my
knowledge, Light is not distributed by any other vendors.
You can find me on IRC as Liandrin, on Undernet in #epic+light, or on EFnet
in #epic.
MD5sums:
6dffeddbb059a145dba2694fd2d04d6e Light-2.7.30p5.tar.bz2
28c6f204e92dd6a1f89724e9e7af80e1 Light-2.7.30p5.tar.bz2.asc
4a815f15c522e016a39c42fc96cb33ad Light-2.7.30p5.tar.gz
570dde757ed65a2b133f24c3406a9399 Light-2.7.30p5.tar.gz.asc
6f201aa5c2fc729766a5b11840bf07a5 Light-2.8pre10.tar.bz2
2d463273545694ef9862a90d3acbbe1c Light-2.8pre10.tar.bz2.asc
c1dde9996bb63be29cc1cfcd56479675 Light-2.8pre10.tar.gz
c56873d39d67243f19874c3c21bff0b2 Light-2.8pre10.tar.gz.asc
(Note to Macintosh and Windows users: the .asc files must be transferred in
BINARY mode for the md5sum to compute correctly. Users of Cygwin's md5sum
command should use the -b (binary mode) flag.)
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.0i for non-commercial use
Charset: noconv
iQCVAwUBPWU2YbDeqAwrixFtAQE8AgP/a4azithVEhuR+atf71TfImSl0l90sFT2
dDQAPO1P2f7/4jxUxhaaBZ+fG4eTeFEGzeUYJiY+ZbssjaYjAiAmKmIsDD6wA4w9
PJQSlreC4En8VhD9/sSEsaRsTnU4QMNJQrZpD6QeVb9ILd5zYqVn40XAQDRcS9wb
ho0y6W1JU+8=
=zTTa
-----END PGP SIGNATURE-----
