Revised Irssi Security Advisory (thnx to aprogas)

---------------------------------------------------------

InvisibleNet Security Advisory ISA 2-1 [email protected]

http://www.invisiblenet.com

December 13th, 2002 - report issued by 0x90

---------------------------------------------------------

Subject: Irssi IRC Client (www.irssi.org) ident bug allowing users to
infiltrate/hijack users private conversations.

Vulnerability: Irssi Client doesn't distinguish nicknames in private
messages if ident info is the same. 

Problem-Type: remote but on same lan or same hostname.

OS Specific: *nix irssi users

Problem Description:
Irssi irc client doesn't distinguish ident info ([email protected])
from the nickname used if ident info is matching other users. 
This can allow an attacker to infiltrate the private message
conversation window by setting his ident info but not his nick to be
identical to the person he wants to impersonate, a sort of man in the
middle attack interception on a private conversation. When this
happens and the attacker messages a user that one is in a query
window with, irssi states that the person they were chatting with has
changed his nick to something else in the same query window, and
continues conversation. The only way this attack is effective is if
the attacker is aware that there is a conversation taking place
between two users, and the irc server either uses the same ident
hostname for every user (example IIP -> www.invisiblenet.net/iip) or
the users are behind the same lan gateway IP. Aside an attacker
standpoint, this can also cause mass confusion for irc users in
general.

Vulnerable Versions:

0.8.6 and any previous versions.

Solution:

/set query_track_nick_changes OFF

Disclaimer:


InvisibleNet is not responsible for the misuse of any of the
information we provide on this website and/or through our security
advisories. 
Our advisories are a service to our customers intended to promote
secure
installation and use of InvisibleNet products.