UnrealIRCd 4.0.9 released (fixes ghost user and memory leak)

[Bram M. <sy...@vu...>]

(You can unsubscribe here 
<https://lists.sourceforge.net/lists/listinfo/unreal-notify> at the bottom of 
the page)

Hi everyone,

An issue was discovered in the UnrealIRCd 4.0.x series which allows you to 
create a "ghost" user. This requires a minimum of two linked UnrealIRCd 4.0.x 
servers. A "ghost" is a user which does not really exist. As with most ghost 
user bugs in the IRC protocol it will cause some confusion/annoyances to users 
but does not lead to any privilege escalation. In this case, however, it can 
also result in UnrealIRCd failing to free resources for the user. The result 
is a memory leak of 400 to 4000 bytes per user. The memory is only freed after 
UnrealIRCd is terminated or restarted. When the bug is abused it is quite 
noticeable as for each successful attempt IRCOps would see a KILL message. To 
put things in perspective: about 25,000 connects are required to consume 100 
MB of memory. Ultimately, an attacker may cause UnrealIRCd to consume so much 
memory that the IRCd will terminate.

We have released UnrealIRCd 4.0.9 which addresses this issue. There is also a 
"hot fix" available so you can patch your server _without requiring an 
UnrealIRCd restart_. See below.

We recommend you to apply the "hot fix" or upgrade somewhere this weekend. 
It's better to do a peaceful planned upgrade now than having to rush an 
upgrade later while people are abusing this bug.

*Affected versions*
All UnrealIRCd 4.0.x versions before 4.0.9

*How to get the fix/patch?*

Windows users should download and install UnrealIRCd 4.0.9.

Linux/BSD/.. users can also install 4.0.9 *OR *you can choose to patch 
UnrealIRCd on-the-fly _without a restart_.
Since the patch is usually the easiest and most user friendly solution, we 
recommend it.
Run the following on the IRC shell:
wget http://www.unrealircd.org/patch/ghostpatcher && sh ghostpatcher

*Q&A*
*Have there been any reports of these bugs being abused by anyone?
*Not yet.

*Should I upgrade?
*The attack is very detectable, but we do recommend an upgrade/hot-fix. It's 
better to do a peaceful planned upgrade than having to rush an upgrade later 
while people are abusing this bug.
*
****Are there any workarounds so I don't have to upgrade?*
**On *NIX, use the hot fix / patch so you don't need to restart UnrealIRCd.
*****
***Can I upgrade without restarting the IRC server?
**On Windows no, but on Linux/BSD/.. yes you can. Run the following on the shell:
wget http://www.unrealircd.org/patch/ghostpatcher && sh ghostpatcher
*
****I don't like the patch script. How I can fix this by hand?
*Open src/modules/m_nick.c in an editor. Around line 478 change:
     (void)strlcpy(sptr->name, nick, NICKLEN);
To:
     (void)strlcpy(sptr->name, nick, NICKLEN+1);
Then save, recompile and rehash your UnrealIRCd.*
*This is exactly the same as the patch script would do.*

How serious is this bug?
*The bug leads to resource consumption and some user confusion. For a full 
explanation see the beginning of this announcement. Then, make your own decision.*
*
*When were these issues reported?*
This issue was reported less than 24 hours before the fix release.

*Updates to this advisory
*This release announcement/advisory can be found here 
<https://forums.unrealircd.org/viewtopic.php?f=1&t=8625>. Small 
corrections/updates will be posted there, if any.*
*

-- 
Bram Matthys
Software developer/IT con...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: 2ABD 57FA 7783 5ADD C5EC  8ED7 DE93 B8B4 7E74 5EB3