CVE-2016-15024: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 3332c5ba9ec3014ddc74e2147190a050eee97bc0. It is recommended to apply a patch to fix this issue. VDB-221478 is the identifier assigned to this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2023-02-19T18:15Z
Repository: https://github.com/doomsider/shadow
Language: Other
Files changed: core/core_loops.dtsd, modules/chatfunctions.dtsd
Commit date: 2016-06-09 20:02:06 -0600
Commit message: Fixed possible exploit, improved existing code

Removed possibility for certain special characters to cause the script
to crash.  Made the chat command function more simple.  Removed use of
eval because it did basically nothing

Diff: diff --git a/core/core_loops.dtsd b/core/core_loops.dtsd
index ee319ee..72c8b22 100644
--- a/core/core_loops.dtsd
+++ b/core/core_loops.dtsd
@@ -87,29 +87,31 @@ core_logloop() {
 			RECIEVEDPARAMETER=( $(mysql --defaults-extra-file=$CONFIGDTSD_INSTALLPATH/core/shadow.cnf -sNe "select PARAMETER from COMMANDDB order by line asc;") )
 # Reset the field seperator so it does not cause issues with the rest of the execution of the script
 			IFS=$OLD_IFS
 # Reset the database so the same command is not read repeatedly 
 			mysql --defaults-extra-file=$CONFIGDTSD_INSTALLPATH/core/shadow.cnf -e "truncate table COMMANDDB;"
-			COMMANDARRAY=0
+			POSITIONCOMMANDARRAY=0
 			PARAMETERARRAY=0
 # Go through each command and parameter received and execute them with eval
-			while [ -n "${RECIEVEDCOMMAND[$COMMANDARRAY]+set}" ]
+			while [ -n "${RECIEVEDCOMMAND[$POSITIONCOMMANDARRAY]+set}" ]
 			do
-				RECIEVEDCOMMAND=${RECIEVEDCOMMAND[$COMMANDARRAY]}
+				RECIEVEDCOMMAND=${RECIEVEDCOMMAND[$POSITIONCOMMANDARRAY]}
 				RECIEVEDPARAMETER=${RECIEVEDPARAMETER[$PARAMETERARRAY]}
 				#echo "executing $RECIEVEDCOMMAND $RECIEVEDPARAMETER"
-				eval $RECIEVEDCOMMAND '$RECIEVEDPARAMETER'
-				let COMMANDARRAY++
+				$RECIEVEDCOMMAND ${RECIEVEDPARAMETER}
+				let POSITIONCOMMANDARRAY++
 				let PARAMETERARRAY++
 			done
 		fi
 	if [ "$LOGACTIVE" = "false" ]
 	then
 		sleep 0.5
 	fi
 	done
 }
+# Trap is used here to restart logloop if it exits due to a bad call
+# trap core_logloop EXIT
 core_makesearchdb() {
 # Make the search database which contains all the search strings and their related functions
 	log_myerasetable SEARCHDB
 	SEARCHVAR=( $(compgen -v | grep LOGSEARCH_ ) )
 	SEARCHARRAY=0
diff --git a/modules/chatfunctions.dtsd b/modules/chatfunctions.dtsd
index c3593c3..2599b56 100644
--- a/modules/chatfunctions.dtsd
+++ b/modules/chatfunctions.dtsd
@@ -30,15 +30,15 @@ chat_log() {
 	RECEIVERNAME=${CUTSTRING%%]*}
 # Removes at the fourth =
 	CUTSTRING=${CUTSTRING#*=}
 # Remove everything after ] to get message
 	MESSAGESTRING=${CUTSTRING%%]*}
-	echo "This was sent to chat log $@"
-	echo "This was the message $MESSAGESTRING"
-	echo "This was sender $SENDERNAME"
-	echo "This was receiver $RECEIVERNAME"
-	echo "This was receivertype $RECEIVERTYPE"
+	#echo "This was sent to chat log $@"
+	#echo "This was the message $MESSAGESTRING"
+	#echo "This was sender $SENDERNAME"
+	#echo "This was receiver $RECEIVERNAME"
+	#echo "This was receivertype $RECEIVERTYPE"
 # [CHAT is error value for SENDERNAME
 	mysql --defaults-extra-file=$CONFIGDTSD_INSTALLPATH/core/shadow.cnf -e "INSERT INTO CHATLOG (SENDER, CHATSTRING, RECIEVER) VALUES (\"$SENDERNAME\",\"$MESSAGESTRING\",\"$RECEIVERNAME\");"
 }
 chat_commands() {
     MYCHATSTRING="${@:1}"
@@ -73,41 +73,31 @@ chat_commands() {
 		echo "Message Cut $MESSAGECUT"
 # Feed the message string into an array so we can work with it as commands		
 		COMMANDARRAY=($MESSAGECUT)
 		USERCOMMAND=${COMMANDARRAY[0]}
 		USERCOMMAND=${USERCOMMAND^^}
+		USERCOMMAND="chatcommand_$USERCOMMAND"
 		USERPARAMETERS=${COMMANDARRAY[@]:1}
 		echo "User is $SENDERNAME"
 		echo "Command is $USERCOMMAND"
 		echo ${#USERCOMMAND}
 		echo "Parameters are $USERPARAMETERS"
-		echo "List of chat commands $CHATCOMMANDS[@]"
-		CHATCOMMANDARRAY=0
-        COMMANDFOUND=false
-		while [ -n "${CHATCOMMANDS[$CHATCOMMANDARRAY]+set}" ] 
-		do
-            CURRENTCHATCOMMAND=${CHATCOMMANDS[$CHATCOMMANDARRAY]}
-#		echo "This is the current Chat Command $CURRENTCHATCOMMAND"
-            CUTCHATCOMMAND=${CURRENTCHATCOMMAND#*_}
-#		echo "This remove chatcommand to get only the command name $CUTCHATCOMMAND"
-            if [ "$CUTCHATCOMMAND" = "$USERCOMMAND" ]
+		#echo "List of chat commands ${CHATCOMMANDS[@]}"
+		if lib_arraycontains CHATCOMMANDS $USERCOMMAND
+		then 
+			echo "Chat command found"
+		    USERCOMMAND=${USERCOMMAND#*_}
+			if check_player_rank_allowed $USERCOMMAND $SENDERNAME
             then
-                echo "Chat Command found"
-                COMMANDFOUND=true
-                if check_player_rank_allowed $USERCOMMAND $SENDERNAME
-                then
-                    eval $CURRENTCHATCOMMAND "$SENDERNAME" $USERPARAMETERS
-                else
-                    echo "Command not authorized"
-                    lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "You do not have permission to use that command!"
-                fi
-                let CHATCOMMANDARRAY++
+				USERCOMMAND="chatcommand_$USERCOMMAND"
+				$USERCOMMAND "$SENDERNAME" $USERPARAMETERS
             else
-                let CHATCOMMANDARRAY++
-            fi
-		done
-		if [ $COMMANDFOUND = false ]
-        then
-            lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "Unknown command. Please use !HELP for a list of the commands you can use"
-        fi
+				echo "Command not authorized"
+				lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "You do not have permission to use that command!"
+			fi
+        
+		else
+			echo "No matching chat command"
+			lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "Unknown command. Please use !HELP for a list of the commands you can use"
+		fi
 	fi	
 }
\ No newline at end of file

Vulnerable code: 			COMMANDARRAY=0
			while [ -n "${RECIEVEDCOMMAND[$COMMANDARRAY]+set}" ]
				RECIEVEDCOMMAND=${RECIEVEDCOMMAND[$COMMANDARRAY]}
				eval $RECIEVEDCOMMAND '$RECIEVEDPARAMETER'
				let COMMANDARRAY++
	echo "This was sent to chat log $@"
	echo "This was the message $MESSAGESTRING"
	echo "This was sender $SENDERNAME"
	echo "This was receiver $RECEIVERNAME"
	echo "This was receivertype $RECEIVERTYPE"
		echo "List of chat commands $CHATCOMMANDS[@]"
		CHATCOMMANDARRAY=0
        COMMANDFOUND=false
		while [ -n "${CHATCOMMANDS[$CHATCOMMANDARRAY]+set}" ] 
		do
            CURRENTCHATCOMMAND=${CHATCOMMANDS[$CHATCOMMANDARRAY]}
#		echo "This is the current Chat Command $CURRENTCHATCOMMAND"
            CUTCHATCOMMAND=${CURRENTCHATCOMMAND#*_}
#		echo "This remove chatcommand to get only the command name $CUTCHATCOMMAND"
            if [ "$CUTCHATCOMMAND" = "$USERCOMMAND" ]
                echo "Chat Command found"
                COMMANDFOUND=true
                if check_player_rank_allowed $USERCOMMAND $SENDERNAME
                then
                    eval $CURRENTCHATCOMMAND "$SENDERNAME" $USERPARAMETERS
                else
                    echo "Command not authorized"
                    lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "You do not have permission to use that command!"
                fi
                let CHATCOMMANDARRAY++
                let CHATCOMMANDARRAY++
            fi
		done
		if [ $COMMANDFOUND = false ]
        then
            lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "Unknown command. Please use !HELP for a list of the commands you can use"
        fi
Fixed code: 			POSITIONCOMMANDARRAY=0
			while [ -n "${RECIEVEDCOMMAND[$POSITIONCOMMANDARRAY]+set}" ]
				RECIEVEDCOMMAND=${RECIEVEDCOMMAND[$POSITIONCOMMANDARRAY]}
				$RECIEVEDCOMMAND ${RECIEVEDPARAMETER}
				let POSITIONCOMMANDARRAY++
# Trap is used here to restart logloop if it exits due to a bad call
# trap core_logloop EXIT
	#echo "This was sent to chat log $@"
	#echo "This was the message $MESSAGESTRING"
	#echo "This was sender $SENDERNAME"
	#echo "This was receiver $RECEIVERNAME"
	#echo "This was receivertype $RECEIVERTYPE"
		USERCOMMAND="chatcommand_$USERCOMMAND"
		#echo "List of chat commands ${CHATCOMMANDS[@]}"
		if lib_arraycontains CHATCOMMANDS $USERCOMMAND
		then 
			echo "Chat command found"
		    USERCOMMAND=${USERCOMMAND#*_}
			if check_player_rank_allowed $USERCOMMAND $SENDERNAME
				USERCOMMAND="chatcommand_$USERCOMMAND"
				$USERCOMMAND "$SENDERNAME" $USERPARAMETERS
				echo "Command not authorized"
				lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "You do not have permission to use that command!"
			fi
        
		else
			echo "No matching chat command"
			lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "Unknown command. Please use !HELP for a list of the commands you can use"
		fi