Re: Goatse Security EMERGENCY RELEASE - RAMPANT VULNERABILITY SPREADING LIKE WILDFIRE

[DiKKy Heartiez <dikkyheartiez () hotmail com>]

A follow-up, we have been contacted by Linksys and are working to correct this vulnerability.  To date, we have not 
been contacted by Netgear, Symantec, or mIRC Co. regarding this flaw.

From: dikkyheartiez () hotmail com
To: full-disclosure () lists grok org uk
Date: Tue, 21 Jun 2011 21:12:56 +0000
Subject: [Full-disclosure] Goatse Security EMERGENCY RELEASE - RAMPANT VULNERABILITY SPREADING LIKE WILDFIRE








We've just stumbled upon a few dangerous exploits which can be used in conjunction to wreak havoc in online chatrooms, 
which could potentially be very dangerous.


Home routers running VXWorks, such as the Netgear 614, 624, and Linksys WRT54G v5 routers, allow remote attackers to 
cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection 
reset, possibly related to the masquerading code for NAT environments, and as demonstrated via (1) a DCC SEND with a 
single long argument, or (2) a DCC SEND with IP, port, and filesize arguments with a 0 value.


Using such a string as 


\001DCC SEND "hello.jpg" 0 0 0


would exploit this flaw.


This exploit is exacerbated by a buffer overflow vulnerability in mIRC version 6.12 whereby using filename longer than 
fourteen characters will cause the client to crash.  By combining these two flaws, we get


\001DCC SEND "loljewsdidwtc.jpg" 0 0 0


which will cause a Denial of Service condition in a minimum of four products.


This would be bad enough, however users of Norton's Personal Firewall product are faced with even more risk.  Symantec 
generally makes the BEST security products on the market and we are very surprised that this slipped through.  Norton's 
Personal Firewall will drop a connection if it detects the string "startkeylogger" or "stopkeylogger" in incoming data. 
 This is to prevent the spread of the new Spybot worm but also has unintended consequences.  By using the string


\001DCC SEND "startkeylogger" 0 0 0


a Denial of Service condition is created on multiple hardware routers and multiple software products.  Such exploits 
have been seen running rampant in channels such as #lulzsec, #anonops, #ix, #nanog, #2600, and #phonelosers.  Please be 
wary of any chats from unknown parties, and keep your software up to date.  We will update you more as this situation 
unfolds.

                                          

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/