egghelp/eggheads community

fanthomatic eggdrop 1.6.15 exploit?

2003-07-17T05:24:24-04:00

I have had a look at the problem reported, and so far am unable to replicate what has been shown.

So far, I have only generated 15 nickname likes those discribed in the report, so guess I might need to try further (500+ say).

There are however a few things to consider in what tests they conducted.

1: They removed scripts, due didn't restart the bot fully
2: Learn users (as sugested)

You should note to them, if they feel there are bugs, to present further and more clear evidance of what happened. It would help a lot if we knew exactly what nicknames and idents caused it to happen on there systems.

As for password sniffing. This is somthing that would also need to be elaborated further. I can name a few ways to sniff out password in eggdrop, but these are known, and are more a side effect of the debug process.

Scripts again can cause this. I have a bug in my own secure logging system that shows peoples passwords (it's still perfectly secure thank god).

While I am not going to deny outright that these issues do not exist, as there may be perfectly good explanations, they may be bugs they may be somthing else. The fact remains, what they presented was small and has obviously never been seen by the development team, there was also a lack of information (though there may be good grounds for that).

Statistics: Posted by ppslim — Thu Jul 17, 2003 5:24 am

fanthomatic eggdrop 1.6.15 exploit?

2003-07-16T10:30:14-04:00

The only thing that comes in my mind about the +n thing is that some (l)users forgot to remove the learn users and/or the open telnets, I mean set them to 0 after they made theyr *first* account, when they are creating the userfile for the first time. Hope this is the *real* problem..

Statistics: Posted by caesar — Wed Jul 16, 2003 10:30 am

fanthomatic eggdrop 1.6.15 exploit?

2003-07-16T09:26:11-04:00

Does there seem to be a real abuse?

Statistics: Posted by Dedan — Wed Jul 16, 2003 9:26 am

fanthomatic eggdrop 1.6.15 exploit?

2003-07-16T06:22:18-04:00

egghead, I forwarded to guppy the infos that the admin gave me about that issues

Statistics: Posted by FIDe` — Wed Jul 16, 2003 6:22 am

fanthomatic eggdrop 1.6.15 exploit?

2003-07-16T02:28:31-04:00

i havent found anything about this yet..(packetstorm etc)

Statistics: Posted by GodOfSuicide — Wed Jul 16, 2003 2:28 am

fanthomatic eggdrop 1.6.15 exploit?

2003-07-15T17:13:40-04:00

I would like to know if there is abuse.
I am not asking for information about
it, just if there is one.

Statistics: Posted by Dedan — Tue Jul 15, 2003 5:13 pm

fanthomatic eggdrop 1.6.15 exploit?

2003-07-15T14:47:01-04:00

ok, I'm going to send a mail to the admin, if he tells me something interesting I will forward it to guppy

Statistics: Posted by FIDe` — Tue Jul 15, 2003 2:47 pm

Re: fanthomatic eggdrop 1.6.15 exploit?

2003-07-15T11:34:57-04:00

today, logging in my outlandz.net shell account, I found this in MOTD:

|
|**NOTICE**
|
| "Eggdrop.1.6.15 is a bug trap. it creates new +n users. do NOT upgrade to it."
Its openly exploitable. |
|
|
|7/14/03

anyone knows about it..?
I hope it's a hoax.
tnx for answers

FIDe`, can you contact the admins of that shell and ask them to forward any info on that exploit, if there is one, and forward it to guppy privately?

Statistics: Posted by egghead — Tue Jul 15, 2003 11:34 am

fanthomatic eggdrop 1.6.15 exploit?

2003-07-15T11:32:33-04:00

not that I know of -- 1.6.15 has bugs but none of them are security ones as far as I know.

Statistics: Posted by guppy — Tue Jul 15, 2003 11:32 am

fanthomatic eggdrop 1.6.15 exploit?

2003-07-15T09:42:19-04:00

today, logging in my outlandz.net shell account, I found this in MOTD:

|
|**NOTICE**
|
| "Eggdrop.1.6.15 is a bug trap. it creates new +n users. do NOT upgrade to it."
Its openly exploitable. |
|
|
|7/14/03

anyone knows about it..?
I hope it's a hoax.
tnx for answers

Statistics: Posted by FIDe` — Tue Jul 15, 2003 9:42 am