Debian Bug report logs - #672214
[supybot] misc.last command can be used to crash the computer where the bot is running

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Mika Suomalainen <mkaysi@users.sourceforge.net>

To: submit@bugs.debian.org

Subject: [supybot] misc.last command can be used to crash the computer where the bot is running

Date: Wed, 09 May 2012 10:35:57 +0300

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Package: supybot
Version: 0.83.4.1.ds-2
Severity: important

- --- Please enter the report below this line. ---

The subject tells everything.
Example command:
> !misc last --regexp m/(.*\w){512}/

This issue has been fixed at least in gribble and Limnoria, which are
Supybot forks.
http://sourceforge.net/apps/mediawiki/gribble/
https://github.com/ProgVal/Limnoria/

Supybot upstream can be considered as dead.

- --- System information. ---
Architecture: amd64
Kernel:       Linux 3.2.0-2-amd64

Debian Release: wheezy/sid
  500 unstable        www.debian-multimedia.org
  500 unstable        ftp.fi.debian.org
  500 unstable        ftp.debian.org
  500 unstable        ftp.acc.umu.se
  500 unstable        deb.torproject.org
  500 testing         dl.google.com
  500 stable          download.webmin.com
  500 stable          dl.google.com
  500 sid             www.lamaresh.net
  500 oneiric         ppa.launchpad.net
  500 experimental-sid deb.torproject.org
  500 all             liveusb.info

- --- Package information. ---
Depends              (Version) | Installed
==============================-+-============
python                (>= 2.3) | 2.7.2-10
python-support     (>= 0.90.0) | 1.0.14


Recommends             (Version) | Installed
================================-+-===========
python-simplejson                | 2.5.0-1
 OR python              (>= 2.6) | 2.7.2-10
python-feedparser                | 5.0.1-1


Suggests                  (Version) | Installed
===================================-+-===========
python-twisted-core                 | 12.0.0-1
python-twisted-names                | 11.1.0-1
python-sqlite                       |
python-dictclient                   |
python-dateutil                     | 1.5-1





- -- 
Mika Suomalainen
gpg --keyserver pool.sks-keyservers.net --recv-keys 4DB53CFE82A46728
Key fingerprint = 24BC 1573 B8EE D666 D10A  AA65 4DB5 3CFE 82A4 6728
http://mkaysi.github.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPqh5VAAoJEE21PP6CpGco/GsQAINX+mwbSElfteYXvfSSKnnR
zZvfVmIQQ52YlGUt2ygweK58qhQsV/Cx3bp5OHytohyf2HnNnC2ls7glOn5sIy9y
ODgEmIgTLXUYLnglOPH/2d2XtZvtbLDiuWMddIy7poMZMWT/sicFlm77NHvRjzH8
nQD2v4Aricsd8ADuQ8/jtA7xSoxuVrT3FCS0ACGYiiwGnGi5uM2pgdbH3v7F5xBQ
inH/VspTJSwND2vZZcHw4vRIprqyIIRM+8rhICj+emW18i+lvlAoLQF2XWXezKab
OU5eoriMqN5LfdXc3kNWR4AZ8XCejt8awUZAnCoBF42QuFjF6XBOc998n2EdYuJa
G/+y60cTAcTw2RxUhrtHt5pUws1/8wb0kTJLGeu0RYKQxQCA1zXyTjRJ25uYsOHY
bsIvurSaVF4RxtuXb5Surj2O7l6noXXzKCwuooj0YaqL4zsskZlIU7u097PQBwQ1
h3b5mha4eiG6FrWppc1D9lqJ6Q72sYjA+6SuEclfkMjtbKbWpZYMUcXuP23q6Xs+
mVC/IJAqPbiF+4d/hsE01zDrTbfhnpsyGvgq7ysN84HH/TjWleqspKxI8vdk9TpO
RvvyNDLenvY8Htr+SNHlIGfWhQ19n2RDzAUyCK+L+XfpIRDxLaI6ypL6dm63XFH8
UkpW4cmEOYpUZJYMDdkF
=oRuR
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.