[ngIRCd-ML] ngIRCd 20.2

Alexander Barton alex at barton.de
Fri Feb 15 13:23:10 CET 2013

Hello ngIRCd'ers!

Sebastian Köhler discovered a severe bug in ngIRCd 20 and 20.1 which can be
exploited by arbitrary users to crash the daemon and to lead to denial of
service. So here is the next "bug fix only" release for the ngIRCd 20 series:
release 20.2.

Please note that all releases before 20 are NOT affected by the bug mentioned
above. But in the end, all installations should upgrade, ngIRCd 20.2 is the
most complete release we have so far, and there should be no reasons to stay
with old versions -- besides distributions not having newer releases ...

Besides the fix for the DoS mentioned above, ngIRCd 20.2 contains other fixes.
The complete ChangeLog lists the following changes:

 • Security: Fix a denial of service bug in the function handling KICK
   commands that could be used by arbitrary users to to crash the daemon.
 • WHO command: Use the currently "displayed hostname" (which can be cloaked!)
   for hostname matching, not the real one. In other words: don't display all
   the cloaked users on a specific real hostname!
 • configure: The header file "netinet/in_systm.h" already is optional in
   ngIRCd, so don't require it in the configure script. Now ngIRCd can be
   built on Minix 3 again :-)
 • Return better "Connection not registered as server link" errors: Now ngIRCd
   returns a more specific error message for numeric ERR_NOTREGISTERED(451)
   when a regular user tries to use a command that isn't allowed for users but
   for servers.
 • Don't report ERR_NEEDMOREPARAMS(461) when a MDOE command with more modes
   than nicknames is handled, as well as for channel limit and key changes
   without specifying the limit or key parameters.
   This is how a lot (all?) other IRC servers behave, including ircd2.11,
   InspIRCd, and ircd-seven. And because of clients (tested with Textual and
   mIRC) sending bogus MODE commands like "MODE -ooo nick", end-users got the
   expected result as well as correct but misleading error messages ...
 • Correctly detect when SSL subsystem must be initialized and take
   outgoing connections (server links!) into account, too.
 • autogen.sh: Enforce serial test harness on GNU automake >=1.13. The
   new parallel test harness which is enabled by default starting with
   automake 1.13 isn't compatible with our test suite.
   And don't use "egrep -o", insetead use "sed", because it isn't portable
   and not available on OpenBSD, for example.

More information can be found on the homepage <http://ngircd.barton.de/>
and its mirror <http://ngircd.berlios.de/>.

The primary download locations are:

 • <ftp://ftp.berlios.de/pub/ngircd/>
 • <http://ngircd.barton.de/pub/ngircd/>


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: Digital signature
URL: <http://arthur.barton.de/pipermail/ngircd-ml/attachments/20130215/99a013c0/attachment.pgp>

More information about the ngIRCd-ML mailing list