Recent changes to bugs

Various clients glined by litmus single-word-version rule

Michael (micolous) — Tue, 10 Jan 2006 05:09:03 -0000

Various IRC clients are wrongfully glined by the
single-word-version reply rule, namely less popular
ones. At the moment, there are work arounds in place
that exempt Trillian, eMule and WebTV from being
glined. However others are glined as they are believed
to the litmus trojan.

To me, manually whitelisting all these clients takes
time, and it also takes time for people to update their
version of IRC Defender, and merge any changes they've
made across to the current version. It also takes time
to try and make this happen on IRC networks that run
the IRC Defender software, that you have no control
over. It would take several weeks before the lastest
small IRC client project is added to the whitelist.
While it is suggested that we modify the IRC clients to
have a >1 word version reply, this is just silly.
Nowhere in the IRC protocol specifications does it say
this is a requirement. And how long before clients
with two word version replies are glined under a
similar ruling?

However, after some investigation, I've found that the
Backdoor.Litmus trojan doesn't present a single word
version reply at all.

John C. Hennessy on Tue, 12 Mar 2002 06:37:10 -0800
wrote: [1]
> A CTCP version request to the clients returned this:
> Litmus 2.03 (C)2001 The Litmus Group :(random quote)

Therefore, it seems that this rule is entirely
redundant. I'm requesting for the behaviour to be
removed, as it seems that it won't stop litmus clients
from connecting to a network at all.

References:
[1]: http://seclists.org/lists/incidents/2002/Mar/0080.html

Will not link to Ultimate 3.0.1

Anonymous — Mon, 09 Jan 2006 14:37:25 -0000

Email: colk@ixswr.org

UltimateIRCd(Tsunami)-3.0(01) xxx :RelStatus=RELEASE
ServOpts=CiIp(TS5ow) Proto=3000
* SAFELIST SILENCE KNOCK FNC WATCH=128 CHANLIMIT=#&:20
MAXLIST=be:60 NICKLEN=30 TOPICLEN=307 KICKLEN=307
CHANNELLEN=32 :are available on this server
* EXCEPTS=e CHANTYPES=#& PREFIX=(aohv)!@%+
CHANMODES=be,k,l,cimnpqstAKMNORS STATUSMSG=!@%+
NETWORK=KDFSnet CASEMAPPING=ascii STD=i-d :are
available on this server

Output from Version and heres what happens when it
tries to link

400 lines of * *** Realops-Notice -- Remote nick
Defender on UNKNOWN server 0

emule irc client rejected

Anonymous — Sun, 31 Jul 2005 23:37:55 -0000

defender detect the emule client same a trojan :

-irc.******.org- *** Notice -- Client connecting on
port 6667: test_client (~103618C7V@*****************)
[clients]
-
-irc.******.org- *** G:Line added for
~103618C7V@************* on Sun Jul 31 23:33:22 2005
GMT (from defender.*********.org to expire at Mon Aug
1 23:33:22 2005 GMT: Possible litmus trojan)
-
-irc.hevenet.org- *** Notice -- Client exiting:
test_client (~103618C7V@*****************) [User has
been banned from ******* (Possible litmus trojan)]

gline borked on hybrid

Anonymous — Tue, 14 Jun 2005 15:55:56 -0000

I don't know why you guys ever did this to begin with
because it never has nor never will work this way, but
in Modules/Link/hybrid.pm in the gline sub you have a
$delta thing going on. If you remove that line and
replace $delta with $duration in the rawirc call it
fixes it. Otherwise all klines expire instantly which
is, you know, bad.

killchan kills opers

Anonymous — Mon, 02 May 2005 18:06:41 -0000

Cloud (cloud@chill4chat.de)

Hi,

I'm running UnrealIRCd v3.2.3 and IRCDefender v1.3.13.
I added #services to the killchan-list and gave my
eggdrop a local o:line. When I let the bot oper-up
(with `.dump oper <loginname> <operpass>' in eggdrop's
DCC-chat) it joined #services as we set up our IRCd to
auto-join anyone who opers into that channel. Then I
got following messages:

irc.main.chill4chat.de *** Notice -- Lobster
(eggdrop@89.million.dollar.bot) is now a local operator (o)
irc.main.chill4chat.de *** G:Line added for
*@chill4chat.de on Mon May 2 17:24:41 2005 GMT (from
defender.chill4chat.de to expire at Mon May 2 17:54:41
2005 GMT: You joined a banned channel (Services_Channel))
*** Notice -- Client exiting: Lobster
(eggdrop@chill4chat.de) [User has been banned from
Chill4Chat (You joined a banned channel
(Services_Channel))]
irc.main.chill4chat.de *** You are banned from
Chill4Chat (You joined a banned channel
(Services_Channel)) Email error ' at' chill4chat.de for
more information.

The bot's (Lobster) vHost was 89.million.dollar.bot, it
actually connected from chill4chat.de (as I did).

With best regards

Cloud

Problems with deny_version.conf syntax

Anonymous — Sat, 26 Feb 2005 01:27:40 -0000

When I attempt to start defender, it says I am using an
outdated deny_version.conf and that it should contain
the action parameter, despite the fact it already does.

irc@bender:~/defender$ perl defender.pl
IRC Defender - Programmed by C.J.Edwards (Brain) -
irc.chatspike.net
Numerous fixes and modules by Whitewolf, typobox43, ol,
Jay, Azhrarn

Loading configuration file...
Using unreal connection module (loaded OK)...

Loading modules...
Loading: Modules/Scan/fyle.pm... OK!
Loading: Modules/Scan/regexp_akill.pm... OK!
Loading: Modules/Scan/version.pm...

WARNING! You are using an outdated version of
deny_version.conf. The format for this file
has changed in this version to contain an 'action'
parameter. Please review your settings
and make sure they match the format given in the README
file.

Not sure what else defender wants, i've added the
parameter, the deny_version.conf parameters are tab
seperated.

NOTE: The bug tracker thing has probably word wrapped
the terminal output here.

killchan private message

Anonymous — Wed, 24 Nov 2004 09:14:31 -0000

killchan allows requests in private message

bahamut 1.8.x support

Anonymous — Sat, 30 Oct 2004 05:36:58 -0000

It doesnt work on bahamut 1.8.x at all.

fizzer without ident enabled get through

Anonymous — Thu, 01 Apr 2004 16:52:07 -0000

In the fizzer scan, the regex to test whether the ident
matches the gecos allows fizzers without ident enabled
( and thus a ~ preceeding the ident field) to get through:

if($gecos =~ /^([A-Z]+) ([A-Z]+)$/i) {

my $droneident = $2 . $1;
$droneident = substr($droneident, 0, 10);

if($ident =~ /^$droneident$/i) {

I'm no regex expert, but I think that last line could
be changed to:

if($ident =~ /^~?$droneident$/i) {

Mike Campbell
mike@avendesora.net