|| ||"J. S. Connell" <email@example.com>|
|| ||Light Security Advisory: Remotely-exploitable code execution|
|| ||Thu, 22 Aug 2002 12:06:50 -0700 (PDT)|
-----BEGIN PGP SIGNED MESSAGE-----
All versions of Light prior to 2.7.30p5 (on the 2.7 branch) or 2.8pre10 (on
the 2.8 branch) running under any version of EPIC4 on any platform are
vulnerable to a remotely-exploitable bug that can execute nearly-arbitrary
code. All Light users are very strongly urged to upgrade to stable release
2.7.30p5 or beta 2.8pre10 immediately. See below for URLs, MD5 hashes, and
I've recently discovered that the IRC script for EPIC4 that I maintain is
vulnerable to a fairly easy remote attack. If a malicious user can convince
a user to join a channel whose name contains embedded EPIC4 script, several
different code paths inside Light will cause that script to be executed.
The attack is mollified by four factors:
1. A user has to be incautious enough to join a channel with embedded code.
2. The embedded code is limited to expanding variables and calling EPIC
built-in functions and user-defined aliases and functions -- built-in
commands cannot be executed.
3. Light does not contain any features for automatically joining channels.
However, it should be pointed out that auto-join-on-invite can be achieved
by simply adding 'on invite * join $1' to one's .ircrc.
4. An unmodified copy of Light will not permit you to run it as root,
slightly limiting potential damage. Yes, you *are* an idiot if you IRC as
root, and this advisory should demonstrate why!
One might be tempted to add a fifth factor -- that channel names cannot
contain spaces -- but EPIC provides built-in functions that provide a
space-free and opaque (to the naked eye) 'transport armour'.
It should also be noted that EPIC4 with *no* scripts loaded is also
vulnerable to this attack, but *only* if the STATUS_DOES_EXPANDOS setting
is changed from its default to ON. (STATUS_DOES_EXPANDOS is, to my mind,
an inherently dangerous feature with valid, but rare, uses. Its existence
typifies the UNIX philosophy: "Here's the gun, the ammo, and the sights,
and if you blow your foot off with them, don't come crying to me.")
Because other IRC scripts may well be vulnerable to this attack or to
other, similar attacks, I do not wish to provide examples of how to exploit
this, although it should be obvious to anyone familiar with EPIC4
Light 2.7.30p5 and Light 2.8pre10 have been released, which resolve this
issue. The tarballs are available for download from:
Updated Debian packages will also available shortly. To the best of my
knowledge, Light is not distributed by any other vendors.
You can find me on IRC as Liandrin, on Undernet in #epic+light, or on EFnet
(Note to Macintosh and Windows users: the .asc files must be transferred in
BINARY mode for the md5sum to compute correctly. Users of Cygwin's md5sum
command should use the -b (binary mode) flag.)
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.0i for non-commercial use
-----END PGP SIGNATURE-----
to post comments)