Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 270221 (CVE-2009-1789) - net-irc/eggdrop Fix for CVE-2007-2807 incomplete, remote DoS (CVE-2009-1789)
Summary: net-irc/eggdrop Fix for CVE-2007-2807 incomplete, remote DoS (CVE-2009-1789)
Status: RESOLVED FIXED
Alias: CVE-2009-1789
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://archives.neohapsis.com/archive...
Whiteboard: B3 [noglsa]
Keywords:
: 271804 (view as bug list)
Depends on: 222483
Blocks:
  Show dependency tree
 
Reported: 2009-05-17 17:21 UTC by Thomas Sader
Modified: 2009-09-14 21:59 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Sader 2009-05-17 17:21:04 UTC 
The patch applied to the gentoo eggdrop package in 1.6.18-r3 (only) by Nico Golde fixing bug 179354 called "80_all_CVE-2007-2807_servmsg.patch" in the patchset archive introduces a new vulnerability which exposes every eggdrop connected to an irc server (which is the main purpose of eggdrop) to be remotely crashable (by someone being on the same irc network).
(I'm not sure about the severity.. it makes the eggdrop packages unusable)

Reproducible: Always

Steps to Reproduce:
Send an empty CTCP via IRC to the eggdrop bot, for example:

PRIVMSG eggdrop :\1\1
Actual Results:  
It segfaults and crashes

Expected Results:  
No reaction

References:
http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0129.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=528778
Comment 1 Alex Miller 2009-05-17 23:31:08 UTC 
A new release of eggdrop was made because of this bug: http://www.eggheads.org/news/2009/05/14/35

patch to fix ctcp issue is also given at ftp://ftp.eggheads.org/pub/eggdrop/patches/official/1.6/eggdrop1.6.19+ctcpfix.patch.gz
Comment 2 Robert Buchholz (RETIRED) gentoo-dev 2009-05-29 22:53:53 UTC 
*** Bug 271804 has been marked as a duplicate of this bug. ***
Comment 3 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-08-02 19:36:42 UTC 
Arches, please test and mark stable:
=net-irc/eggdrop-1.6.19
Target keywords : "alpha amd64 ia64 ppc sparc x86"
Comment 4 Markus Meier gentoo-dev 2009-08-03 20:10:34 UTC 
amd64/x86 stable
Comment 5 nixnut (RETIRED) gentoo-dev 2009-08-09 11:35:39 UTC 
ppc stable
Comment 6 Raúl Porcel (RETIRED) gentoo-dev 2009-08-09 16:46:06 UTC 
alpha/ia64/sparc stable
Comment 7 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-08-19 10:57:54 UTC 
GLSA voting: NO
Comment 8 Stefan Behte (RETIRED) gentoo-dev Security 2009-09-14 21:59:06 UTC 
NO, too. Closing.