fanthomatic eggdrop 1.6.15 exploit?

FIDe` · Post by **FIDe`** » Tue Jul 15, 2003 9:42 am

today, logging in my outlandz.net shell account, I found this in MOTD:

|
|**NOTICE**
|
| "Eggdrop.1.6.15 is a bug trap. it creates new +n users. do NOT upgrade to it."
Its openly exploitable. |
|
|
|7/14/03

anyone knows about it..?
I hope it's a hoax.
tnx for answers

guppy · Post by **guppy** » Tue Jul 15, 2003 11:32 am

not that I know of -- 1.6.15 has bugs but none of them are security ones as far as I know.

egghead · Post by **egghead** » Tue Jul 15, 2003 11:34 am

FIDe` wrote:today, logging in my outlandz.net shell account, I found this in MOTD:

|
|**NOTICE**
|
| "Eggdrop.1.6.15 is a bug trap. it creates new +n users. do NOT upgrade to it."
Its openly exploitable. |
|
|
|7/14/03

anyone knows about it..?
I hope it's a hoax.
tnx for answers

FIDe`, can you contact the admins of that shell and ask them to forward any info on that exploit, if there is one, and forward it to guppy privately?

FIDe` · Post by **FIDe`** » Tue Jul 15, 2003 2:47 pm

ok, I'm going to send a mail to the admin, if he tells me something interesting I will forward it to guppy

Dedan · Post by **Dedan** » Tue Jul 15, 2003 5:13 pm

I would like to know if there is abuse.
I am not asking for information about
it, just if there is one.

GodOfSuicide · Post by **GodOfSuicide** » Wed Jul 16, 2003 2:28 am

i havent found anything about this yet..(packetstorm etc)

FIDe` · Post by **FIDe`** » Wed Jul 16, 2003 6:22 am

egghead, I forwarded to guppy the infos that the admin gave me about that issues

Dedan · Post by **Dedan** » Wed Jul 16, 2003 9:26 am

Does there seem to be a real abuse?

Post by **caesar** » Wed Jul 16, 2003 10:30 am

The only thing that comes in my mind about the +n thing is that some (l)users forgot to remove the learn users and/or the open telnets, I mean set them to 0 after they made theyr *first* account, when they are creating the userfile for the first time. Hope this is the *real* problem..

ppslim · Post by **ppslim** » Thu Jul 17, 2003 5:24 am

I have had a look at the problem reported, and so far am unable to replicate what has been shown.

So far, I have only generated 15 nickname likes those discribed in the report, so guess I might need to try further (500+ say).

There are however a few things to consider in what tests they conducted.

1: They removed scripts, due didn't restart the bot fully
2: Learn users (as sugested)

You should note to them, if they feel there are bugs, to present further and more clear evidance of what happened. It would help a lot if we knew exactly what nicknames and idents caused it to happen on there systems.

As for password sniffing. This is somthing that would also need to be elaborated further. I can name a few ways to sniff out password in eggdrop, but these are known, and are more a side effect of the debug process.

Scripts again can cause this. I have a bug in my own secure logging system that shows peoples passwords (it's still perfectly secure thank god).

While I am not going to deny outright that these issues do not exist, as there may be perfectly good explanations, they may be bugs they may be somthing else. The fact remains, what they presented was small and has obviously never been seen by the development team, there was also a lack of information (though there may be good grounds for that).

egghelp/eggheads community

fanthomatic eggdrop 1.6.15 exploit?

fanthomatic eggdrop 1.6.15 exploit?

Re: fanthomatic eggdrop 1.6.15 exploit?