From bb10d54844058626b70d1bebcb62e1a0e70e0781 Mon Sep 17 00:00:00 2001 From: Alyx Date: Wed, 13 Apr 2011 19:58:25 -0500 Subject: [PATCH] =?UTF-8?q?Fixed=20easily=20exploitable=200day=20involving?= =?UTF-8?q?=20wide=20characters.=20Slightly=20surprised=20no=20one=20has?= =?UTF-8?q?=20triggered=20this=20yet,=20as=20exploitation=20involves=20not?= =?UTF-8?q?hing=20more=20than=20having=20Auto=20send=20a=20>8-byte=20chara?= =?UTF-8?q?cter=20(,=20"=F0=9D=84=9E"),=20via=20doing=20something=20like?= =?UTF-8?q?=20using=20LinkTitle.pm=20and=20putting=20the=20character=20int?= =?UTF-8?q?o=20the=20=20field..=20This=20is=20a=20MAJOR=20security?= =?UTF-8?q?=20exploiit,=20and=20any=20user=20using=20a=20module=20where=20?= =?UTF-8?q?Auto=20would=20echo=20user-defined=20data=20should=20update=20i?= =?UTF-8?q?mmediately.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lib/Lib/Auto.pm | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/Lib/Auto.pm b/lib/Lib/Auto.pm index 5e9f09f..dbfe643 100644 --- a/lib/Lib/Auto.pm +++ b/lib/Lib/Auto.pm @@ -211,6 +211,7 @@ sub ircsock { $Auto::SOCKET{$svrname} = IO::Socket::INET->new(%conndata) or # Or error. err(2, 'Failed to connect to server ('.$ERRNO.'): '.$svrname.' ['.$cdata->{'host'}[0].q{:}.$cdata->{'port'}[0].']', 0) and delete $Auto::SOCKET{$svrname} and next; + binmode($Auto::SOCKET{$svrname}, ':encoding(UTF-8)'); } }