CVE:CVE-2007-1397
CNNVD:CNNVD-200703-321
fish（也称fish-shell）是挪威软件开发者Axel Liljencrantz所研发的一个专注于交互应用、易用性和友好的用户体验的Unix shell（命令行界面），它支持语法高亮显示、高级的Tab键自动补完等功能。
FiSH的xchat插件实现上存在多个缓冲区溢出漏洞，远程攻击者可能利用这些漏洞控制用户机器。
FiSH的xchat插件代码在处理入站数据时会注册4个函数：
xchat_hook_server(ph, "PRIVMSG", XCHAT_PRI_NORM, decrypt_incoming, 0);
xchat_hook_server(ph, "NOTICE", XCHAT_PRI_NORM, notice_received, 0);
xchat_hook_server(ph, "TOPIC", XCHAT_PRI_NORM, decrypt_incoming, 0);
xchat_hook_server(ph, "NICK", XCHAT_PRI_NORM, nick_changed, 0);
xchat_hook_server(ph, "332", XCHAT_PRI_NORM, decrypt_topic_332, 0);
在所有这些函数中：
int decrypt_incoming(char *word[], char *word_eol[], void *userdata)
{
unsigned char *msg_ptr, contactName[100]="", from_nick[50], msg_event[100]="",
psyNetwork[12];
...
if(word[1][0] == ':') ExtractRnick(from_nick, word[1]);
...
}
这里ExtractRnick()执行的是:
int ExtractRnick(char *Rnick, char *incoming_msg)
{
int k=0;
if(*incoming_msg == ':') incoming_msg++;
while(*incoming_msg!='!' && *incoming_msg!=0) {
Rnick[k]=*incoming_msg;
incoming_msg++;
k++;
}
Rnick[k]=0;
if (*Rnick < '0') return FALSE;
else return TRUE;
}
由于word[1]来自用户，因此可能出现栈溢出。其他3个函数也存在类似问题：
int notice_received(char *word[], char *word_eol[], void *userdata)
{
unsigned int i;
unsigned char hisPubKey[300], contactName[25]="", from_nick[25]="";
...
if(ExtractRnick(from_nick, word[1])==0) return XCHAT_EAT_NONE;
...
}
int nick_changed(char *word[], char *word_eol[], void *userdata)
{
unsigned char contactName[100]="", theKey[500]="", ini_nicktracker[10];
...
if( *ini_nicktracker=='0' || *ini_nicktracker=='N' || *ini_nicktracker=='n' ||
(ExtractRnick(contactName, word[1])==0) ||
(stricmp(contactName, word[3]+1)==0))
return XCHAT_EAT_NONE;
...
}
int decrypt_topic_332(char *word[], char *word_eol[], void *userdata)
{
unsigned char contactName[100]="";
...
strcpy(contactName, word[4]);
...
}
solution:Upgrade fish fish to a higher version than *