Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 10275 - net-irc/ircd-hybrid<7.0.2: Low bandwidth DoS vulnerability
Summary: net-irc/ircd-hybrid<7.0.2: Low bandwidth DoS vulnerability
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: x86 Linux
: High normal
Assignee: Gentoo Security
URL:
Whiteboard: ~3 [stable] lewk
Keywords: EBUILD
Depends on:
Blocks:
 
Reported: 2002-11-05 10:36 UTC by pasi.valminen
Modified: 2011-10-30 22:39 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
hybrid-7.ebuild (hybrid-7.tar.bz2,3.45 KB, application/octet-stream)
2002-11-05 10:38 UTC, pasi.valminen
no flags Details
ircd-hybrid-7-r6.ebuild nad other files (ircd-hybrid.tar.bz2,5.45 KB, application/octet-stream)
2002-12-27 16:04 UTC, pasi.valminen
no flags Details
ircd-hybrid-7.0_rc10 (ircd-hybrid-7.0_rc10.tar.bz2,5.75 KB, application/x-bzip2)
2003-06-09 13:16 UTC, pasi.valminen
no flags Details
irc-hybrid-7.0 ebuild (ircd-hybrid-7.0.tar.bz2,6.04 KB, application/x-bzip2)
2003-06-18 09:47 UTC, pasi.valminen
no flags Details
ircd-hybrid-7.0 ebuild with a minor path fix. (ircd-hybrid-7.0.tar.bz2,6.05 KB, application/x-bzip2)
2003-06-18 10:01 UTC, pasi.valminen
no flags Details
Ebuild suggestions (ircd-hybrid-suggestions,1.91 KB, patch)
2003-11-28 16:05 UTC, Chuck Short (RETIRED)
no flags Details | Diff
irc-hybrid-7.0-r2 ebuild (dirty ipv4+ipv6 hack) (ircd-hybrid-7.0-r2.tar.bz2,5.25 KB, application/x-bzip2)
2003-12-04 14:00 UTC, pasi.valminen
no flags Details
ircd-hybrid-7.0.1 ebuild and stuff (ircd-hybrid-7.0.1.tar.bz2,6.32 KB, application/x-bzip2)
2004-05-15 10:11 UTC, pasi.valminen
no flags Details
ircd-hybrid-7.0.2 ebuild and stuff (ircd-hybrid-7.0.2.tar.bz2,6.40 KB, application/x-bzip2)
2004-06-25 03:45 UTC, pasi.valminen
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description pasi.valminen 2002-11-05 10:36:04 UTC
Attached hybrid-7.tar.bz2 containing hybrid-7.ebuild, files/conf.d_ircd,
files/init.d_ircd, files/Makefile.diff and the digest file. The Makefile.diff
patch will remove symlink creation from the original Makefile. The symlinks are
done with dosym in the ebuild. conf.d_ircd contains command line parameters for
ircd and init.d_ircd is the init script. 

Hybrid7 is an IRC daemon. http://ircd-hybrid.com. It's rc4 release so I've used
KEYWORDS="~x86". 

I suggest net-irc/hybrid.
Comment 1 pasi.valminen 2002-11-05 10:38:28 UTC
Created attachment 5389 [details]
hybrid-7.ebuild
Comment 2 pasi.valminen 2002-12-27 16:01:34 UTC
I created a new ebuild for the rc6 release. 

The patch is smarter since now it patches Makefile.in files. The patch is needed
to make 'make install' respects options given to the ./configure (install dirs)
so I can mount my /usr ro :) FHS r0cks, paranoid security. The patch also makes
${CFLAGS} work and changes config.h variables to those given to the configure. 

There are also /etc/conf.d/ircd and /etc/init.d/ircd files attached as well as
(only) one .diff and the digest file with the actual .ebuild. I'll attach a
tarball soon. I changed the name into ircd-hybrid-7-r6.ebuild. Couldn't use
ircd-hybrid-7-rc6 since portage won't undestand it but I guess it's ok. 

BTW the previous build (rc4) didn't crash even once during this 2 months while I
ran a small campus ircd to guys who think instant messangers suck :)
Comment 3 pasi.valminen 2002-12-27 16:04:58 UTC
Created attachment 6787 [details]
ircd-hybrid-7-r6.ebuild nad other files
Comment 4 Jon Portnoy (RETIRED) gentoo-dev 2003-04-23 19:27:18 UTC
GMSoft - giving this to you because you committed dancer-ircd and dancer is hybrid based
Comment 5 Guy Martin (RETIRED) gentoo-dev 2003-04-24 04:58:54 UTC
Okay I will check this in a week. I'm really busy now. 
Comment 6 pasi.valminen 2003-04-24 05:50:20 UTC
Since ircd-hybrid-7.0rc9 is already out I am planning to update the ebuild, not until my courses are over though. Maybe late May would be a good estimate. 
Comment 7 Guy Martin (RETIRED) gentoo-dev 2003-06-08 17:26:29 UTC
Sorry, I have exams now and I don't have the time to spend on this bug now. I'll work 
it in one or two weeks perhaps more. 
 
Comment 8 pasi.valminen 2003-06-09 13:11:52 UTC
Ok, sorry it took so long, but here's the rc10 ebuild. Haven't set it up yet but the build and install looks good. Will tell if I notice any bugs etc. 
Comment 9 pasi.valminen 2003-06-09 13:16:05 UTC
Created attachment 13010 [details]
ircd-hybrid-7.0_rc10

Extracting the tarball will create net-irc/ircd-hybrid/ dir and extract files
there. Files included: the ebuild, a patch, init script and respective conf.d
config file and digest as well as Manifest file.
Comment 10 pasi.valminen 2003-06-14 10:54:37 UTC
Wow, seems 7.0 has been released. I'll update the ebuild tomorrow if i can find the time :)
Comment 11 pasi.valminen 2003-06-18 09:47:18 UTC
Created attachment 13474 [details]
irc-hybrid-7.0 ebuild

Finally the ebuild for the newly released irc-hybrid-7.0. Late as usual. Sorry
about that. Changed the actual binary location to /usr/sbin and added notices
for ipv6 USE flag since it disables ipv4 in the daemon.

The tarball includes:
net-irc/ircd-hybrid/ircd-hybrid-7.0.ebuild
net-irc/ircd-hybrid/Manifest
net-irc/ircd-hybrid/files/conf.d_ircd
net-irc/ircd-hybrid/files/init.d_ircd
net-irc/ircd-hybrid/files/digest-ircd-hybrid-7.0
net-irc/ircd-hybrid/files/ircd-hybrid-7.0.diff

Enjoy.
Comment 12 pasi.valminen 2003-06-18 10:01:19 UTC
Created attachment 13475 [details]
ircd-hybrid-7.0 ebuild with a minor path fix.

Ok. Had to forget something. I forgot to change the path in to the init script.
Fixed.
Comment 13 Guy Martin (RETIRED) gentoo-dev 2003-11-13 07:54:37 UTC
Sorry, I really don't have time to work on this. I'm really too busy with the hppa port.
Comment 14 pasi.valminen 2003-11-13 08:22:40 UTC
Np. Everyone who asked for it, already got it ;)

If you enable ipv6, ipv4 is disabled. So I did a dirty hack... but won't submit it here ('cause it's all dirty :P). Basicly it builds ipv4 and ipv6 versions and then installs those needed for ipv6 in another path or with -ipv6 suffix. Then you can just run two servers and link'em. Up and running so if you need it, you can come and ask for it at #gentoo-fi.
Comment 15 Chuck Short (RETIRED) gentoo-dev 2003-11-28 16:05:49 UTC
Created attachment 21422 [details, diff]
Ebuild suggestions

Hi,

I had a look at your ebuild and it looks pretty complete. However there are
some nitpicking issues that I addressed in the attached patch.

I also noticed that you did not assign the copyright to the ebuild to gentoo.
Do you wish to assign the copyright of your ebuild to gentoo?

If you address the patch then I would not have a problem adding it to cvs.

Thanks
Chuck
Comment 16 pasi.valminen 2003-12-04 13:03:55 UTC
The patch looks good. Just a small typo. It should be "mirror:", right :) 

And you can add the copyrights to gentoo.
Comment 17 pasi.valminen 2003-12-04 13:58:38 UTC
Ok. Found some extra time and cleaned up a little the ipv4 + ipv6 ebuild, the dirty hack I was talking about (I'm using this ebuild myself). Basically it builds two daemons, one for ipv4 and other for ipv6, if you have ipv6 use flag set that is. 

Benefits? You can have ipv4 and ipv6 support in the same box. Both versions are under package management, that is, can be nicely uninstalled. I don't know if this can be done with SLOT so that unmerging the other version won't remove the files that are common for both versions? I guess using SLOT this way would be a nicer thing.

Why this is dirty? It modifies the original file names in the header files so that they have either -ipv4 or -ipv6 added into them (usually before the suffix). This goes for pid files, config files (e.g ircd-ipvN.conf) and the actual deamons (ircd-ipvN) and so on. But I haven't documented these anywhere which is somewhat confusing if you read the man page for example, which is not updated. It still has the original file names and so on.

Anyway, one person has requested this so I'm putting it here for public viewing in case someone needs it. IMO it should not be added to the portage tree without doing some documentation.

Submitting shortly...
Comment 18 pasi.valminen 2003-12-04 14:00:12 UTC
Created attachment 21709 [details]
irc-hybrid-7.0-r2 ebuild (dirty ipv4+ipv6 hack)

Contents:
ircd-hybrid-7.0-r2.ebuild
files/conf.d_ircd
files/config-ipv4.diff
files/config-ipv6.diff
files/init.d_ircd
files/ircd-hybrid-7.0-r2.diff
Comment 19 Chuck Short (RETIRED) gentoo-dev 2003-12-16 18:38:06 UTC
Added to cvs thanks for the ebuild.
Comment 20 Chuck Short (RETIRED) gentoo-dev 2003-12-16 18:38:33 UTC
Added to cvs thanks for the ebuild.
Comment 21 Chuck Short (RETIRED) gentoo-dev 2003-12-22 06:15:04 UTC
duh this is supposed to be closed
Comment 22 pasi.valminen 2004-05-15 10:10:08 UTC
ircd-hybrid-7.0.1 is out so I made an ebuild for it. All the changes made to ircd-hybrid-7.0-r1 are also included.

I noticed the user and group has been changed, so I fixed some chown thingies too so they use correct uid:gid now. Also fixed a typo and the init script to use the new uid and gid as well as added rehash function to the init script. The ebuild also had a very st00pid thing (originally by me) so it overwrote the current configs on rebuild/upgrade. I also removed that thing.

I was lazy so adding these changes will make old ebuilds fail (due to wrong uid and gid in init scripts). Ebuild works for me, both ipv4 and ipv6 versions. Init scripts seem to start/stop/restart/rehash properly. 

I'll post the ebuild in a minute. Contents of the tarball:
ircd-hybrid/ircd-hybrid-7.0.1.ebuild
ircd-hybrid/files/init.d_ircd
ircd-hybrid/files/conf.d_ircd
ircd-hybrid/files/config-ipv4-7.0.1.diff
ircd-hybrid/files/config-ipv6-7.0.1.diff
ircd-hybrid/files/ircd-hybrid-7.0.1.diff
Comment 23 pasi.valminen 2004-05-15 10:11:36 UTC
Created attachment 31486 [details]
ircd-hybrid-7.0.1 ebuild and stuff

Obsoletes all previous :)
Comment 24 pasi.valminen 2004-06-25 03:45:18 UTC
Created attachment 34117 [details]
ircd-hybrid-7.0.2 ebuild and stuff

There's a remote low-bandwidth DoS vulnerability in ircd-hybrid-7.0.1 and prior

http://www.securiteam.com/unixfocus/5CP0Q0AD5W.html
so I made an ebuild for 7.0.2. The ebuild is based on that of 7.0.1 I submitted
earlier and thus obsoletes the previous.

Contents of the tarball:
ircd-hybrid/
ircd-hybrid/files/
ircd-hybrid/files/config-ipv4-7.0.2.diff
ircd-hybrid/files/config-ipv6-7.0.2.diff
ircd-hybrid/files/init.d_ircd
ircd-hybrid/files/ircd-hybrid-7.0.2.diff
ircd-hybrid/files/conf.d_ircd
ircd-hybrid/ircd-hybrid-7.0.2.ebuild

Tested on three different boxes for now. Seem to work fine.
Comment 25 pasi.valminen 2004-06-25 03:47:38 UTC
Changing severity (if I'm allowed) because of the DoS vulnerability.
Comment 26 pasi.valminen 2004-09-23 13:42:37 UTC
This low bandwidth DoS vulnerability fix has been here for a long time now! Bump it already or remove the ebuild from portage for good. Ok? Pretty plz? 

And pretty pretty plz, test the ebuild at least ONCE before you submit them. I say this because 7.0-r1 is not tested. Not once. Try it out. 7.0.2 worked for me in June. 7.0.3 has been out for a while. I won't submit anymore ebuilds for this package because it seems to be in vain.
Comment 27 Thierry Carrez (RETIRED) gentoo-dev 2004-09-23 13:51:17 UTC
To Reporter : If this is a security problem, it should have been assigned to security at the beginning, not two years after bug creation. Anyway, we'll take it from here.

net-irc : bump this or kill the package please.
Comment 28 SpanKY gentoo-dev 2004-09-23 18:49:17 UTC
when this bug was filed, the security team didnt exist :p
Comment 29 Sven Wegener gentoo-dev 2004-09-26 17:39:12 UTC
I commited 7.0.3 to CVS. Please test.
Comment 30 Luke Macken (RETIRED) gentoo-dev 2004-09-26 18:15:52 UTC
archs, please mark net-irc/ircd-hybrid-7.0.3 stable.
Comment 31 Luke Macken (RETIRED) gentoo-dev 2004-09-27 07:53:44 UTC
Oops, this doesn't need to be marked stable.

ppc, please mark this package ~ppc.
Comment 32 Pieter Van den Abeele (RETIRED) gentoo-dev 2004-09-27 09:01:10 UTC
done
Comment 33 Luke Macken (RETIRED) gentoo-dev 2004-09-27 09:19:41 UTC
Closing without GLSA.