Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 29 Jan 2013 17:37:19 +0200
From: Henri Salo <>
Subject: ircd-hybrid: Denial of service vulnerability in

Mr. Bob Nomnomnom from Torland reported a denial of service security
vulnerability in ircd-hybrid. Function hostmask.c:try_parse_v4_netmask() is
using strtoul to parse masks. Documentation says strtoul can parse "-number" as
well. Validation of input does not catch evil bits. I can give proof of concept
if needed.

Fixed in commit:
Fixed in: ircd-hybrid 8.0.6

I have requested CVE identifier for this vulnerability in another email to Kurt.
Other ircds are using the same code. Consider this email as official advisory. I
tried to embargo this issue, but the commit is out already.

Program received signal SIGSEGV, Segmentation fault.
0x000000000041c799 in try_parse_v4_netmask (text=<value optimized out>, addr=0x113e270, b=0x113e2f8) at hostmask.c:229
229     addb[bits / 8] &= ~((1 << (8 - bits % 8)) - 1);

Henri Salo

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.