|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
mIRC DCC Server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a DCC session is initiated to the target, which will disclose the dcc-server's owner/nick resulting in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Technical |
The DDE Server protocol has four subprotocols: Chat, Fserve, Send and Get
Each subprotocol can be enabled/disabled in mIRC's settings. If the subprotocol is disabled, the server returns: 150 unavailable, and no nickname is disclosured. If the client rejects the session, the server sends: 151 rejected, and no nickname is disclosured. The subprotocol GET is only accepted for clients already connected to the Fserve subprotocol. All attempts to use Get without an successfully FSERVE connection established is rejected with the message: 150 unavailable
Chat Protocol:
Client connects to Server and sends:
100 clientnickname
When Server receives this, it sends:
101 servernickname
Connection is established, users can now chat.
Fserve Protocol:
Client connects to Server and sends:
110 clientnickname
When Server receives this, it sends:
111 servernickname
Connection is established, user can now access fserve.
Send Protocol:
Client connects to Server and sends:
120 clientnickname filesize filename
When Server receives this, it sends:
121 servernickname resumeposition
Where resumeposition is between 0 and filesize, and is required.
Connection is established, and Server dcc gets the file.
Get Protocol:
Client connects to Server and sends:
130 clientnickname filename
When Server receives this, it sends:
131 servernickname filesize
When Client receives this, it sends:
132 clientnickname resumeposition
Where resumeposition is between 0 and filesize, and is required.
Connection is established, and Server dcc sends the file.
Default port for this server is port 59/TCP.
|
|
Solution |
Upgrade to version 6.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
Additionally, a new feature added in mIRC 6.1 allows you to change/spoof the nickname associated with a dcc send/get/chat/fserve:
/dcc nick -sgcf <oldnick> <newnick>
|
|
Products |
|
mIRC
 |
6.0 |
6.01 |
|
|
|
|
Credit |
- James Evans - jae7
 lehigh.edu -
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
