Advisory: Infobot 0.44.5.3 and below vulnerability [Hack-X] This version and versions from before were also released into the FreeBSD ports tree. Currently there is no patched version even though I emailed the author over a month ago about this and emailed the development list over a week, and them saying it would be fixed immidiately although still isn't. A patch follows below. Author: Samy Kamkar [CommPort5@LucidX.com] Special thanks to zsvx for helping find this problem and testing it on multiple infobots. I. Background Infobot is an IRC bot written in perl for information retrieval and storage along with channel management and many other useful tasks. II. Problem Description Infobot has a 'fortran math' section that's used with the 'calc' command via IRC. If someone were to message (privately or in a channel) with 'calc 1+1' (assuming fortran math is enabled in the config file), the bot would return '2'. The problem is the way this function works. It uses open() to run `bc`, which does the actual math. The original code was open(P, "echo $parm|bc 2>&1 |"); which allowed someone to use |'s to escape the echo and run anything through open(). Although, whitespaces are eliminated from user-input with fortran math so this eliminates a lot of possibilities. They soon fixed this bug with open(P, "echo '$parm'|bc 2>&1 |"); This only opened up another hole. A user is now able to escape the echo by using single-quotes and semicolons, but they are stlil unable to use whitespaces. To get around the whitespaces, the user is able to use a local variable set in the terminal. $IFS is, by default on almost all systems, a newline character or whitespace. Either of these would work, so in code you would be able to replace a whitespace with $IFS. III. Impact Any malicious user would be able to run arbitrary files writable by the user running infobot. They would also be able to recieve information or write, since infobot automatically replies the data the open() sent. A user would be able to easily check the operating system and gain other information like so: calc ';uname$IFS"-a";' or in older versions: calc |uname$IFS"-a"| They would also be able to install arbitrary files and execute them. IV. Workaround Disable fortran math in the infobot configuration file and restart the infobot. V. Solution The best solution would be to parse out certain characters from the user's input. You can do this by adding a line to src/Math.pl in the infobot's main directory. You will see on line 40: $parm =~ s/\s//g; After this line, create a new line and insert this: $parm =~ s/[\|;']//g; Save the file (src/Math.pl) and restart infobot. -- Samy Kamkar -- (877)-383-4980 -- CommPort5@LucidX.com LucidX.com / pdump.org / LA.pm.org