Irssi ident bug

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------

InvisibleNet Security Advisory ISA 2-1 [email protected]

http://www.invisiblenet.com

December 13th, 2002 - report issued by 0x90

- ---------------------------------------------------------

Subject: Irssi IRC Client (www.irssi.org) ident bug allowing users to
infiltrate/hijack users private conversations.

Vulnerability: Irssi Client doesn't distinguish nicknames in private
messages if ident info is the same. 

Problem-Type: remote but on same lan or same hostname.

OS Specific: *nix irssi users

Problem Description:
Irssi irc client doesn't distinguish ident info ([email protected])
from the nickname used if ident info is matching other users. 
This can allow an attacker to infiltrate the private message
conversation window by setting his ident info but not his nick to be
identical to the person he wants to impersonate, a sort of man in the
middle attack interception on a private conversation. When this
happens and the attacker messages a user that one is in a query
window with, irssi states that the person they were chatting with has
changed his nick to something else in the same query window, and
continues conversation. The only way this attack is effective is if
the attacker is aware that there is a conversation taking place
between two users, and the irc server either uses the same ident
hostname for every user (example IIP -> www.invisiblenet.net/iip) or
the users are behind the same lan gateway IP. Aside an attacker
standpoint, this can also cause mass confusion for irc users in
general.

Vulnerable Versions:

0.8.6 and any previous versions.

Solution:

Solution is being able to check the nick as well as ident info to
properly distinguish users for private messages, or rough cut, if a
private message is from a new nick, spawn a separate window. 

Patch:

A patch is not available at this time, for iip users specifically, it
is advised to discontinue use of irssi on IIP till a patch has been
released.
Note: InvisibleNet is working on a temporary patch until there is one
officially released from irssi.org.

Disclaimer:


InvisibleNet is not responsible for the misuse of any of the
information we provide on this website and/or through our security
advisories. 
Our advisories are a service to our customers intended to promote
secure
installation and use of InvisibleNet products.





- --0x90--
I'd crawl over an acre of "Visual This++" and "Integrated Development
That" to get to gcc, Emacs, and gdb.  Thank you.

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBPfqANjep2+UpsNFNEQIN4wCgg7JXy2N9feLkg7BRfvqSab0mdCAAn1JO
Ztu7tg104IvqOdiRFrNhN7tl
=uu9T
-----END PGP SIGNATURE-----