CVE-2016-15024 (published 2023-02-19T18:15Z)

A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 3332c5ba9ec3014ddc74e2147190a050eee97bc0. It is recommended to apply a patch to fix this issue. VDB-221478 is the identifier assigned to this vulnerability.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/doomsider/shadow
commit_details: repo_url: https://github.com/doomsider/shadow
author: Reed Harding (AKA Doomsider)
author_date: 2016-06-09 20:02:06-06:00
msg: Fixed possible exploit, improved existing code

Removed possibility for certain special characters to cause the script
to crash.  Made the chat command function more simple.  Removed use of
eval because it did basically nothing
repository: repo_url: https://github.com/doomsider/shadow
repo_name: doomsider/shadow
description: Shadow is a script that works with Mysql to gather data and interact with game servers
repo_language: Shell
owner: doomsider
file_changes: filename: core_loops.dtsd
change_type: ModificationType.MODIFY
diff: @@ -89,16 +89,16 @@ core_logloop() {
 			IFS=$OLD_IFS
 # Reset the database so the same command is not read repeatedly 
 			mysql --defaults-extra-file=$CONFIGDTSD_INSTALLPATH/core/shadow.cnf -e "truncate table COMMANDDB;"
-			COMMANDARRAY=0
+			POSITIONCOMMANDARRAY=0
 			PARAMETERARRAY=0
 # Go through each command and parameter received and execute them with eval
-			while [ -n "${RECIEVEDCOMMAND[$COMMANDARRAY]+set}" ]
+			while [ -n "${RECIEVEDCOMMAND[$POSITIONCOMMANDARRAY]+set}" ]
 			do
-				RECIEVEDCOMMAND=${RECIEVEDCOMMAND[$COMMANDARRAY]}
+				RECIEVEDCOMMAND=${RECIEVEDCOMMAND[$POSITIONCOMMANDARRAY]}
 				RECIEVEDPARAMETER=${RECIEVEDPARAMETER[$PARAMETERARRAY]}
 				#echo "executing $RECIEVEDCOMMAND $RECIEVEDPARAMETER"
-				eval $RECIEVEDCOMMAND '$RECIEVEDPARAMETER'
-				let COMMANDARRAY++
+				$RECIEVEDCOMMAND ${RECIEVEDPARAMETER}
+				let POSITIONCOMMANDARRAY++
 				let PARAMETERARRAY++
 			done
 		fi
@@ -108,6 +108,8 @@ core_logloop() {
 	fi
 	done
 }
+# Trap is used here to restart logloop if it exits due to a bad call
+# trap core_logloop EXIT
 core_makesearchdb() {
 # Make the search database which contains all the search strings and their related functions
 	log_myerasetable SEARCHDB

programming_language: Shell
filename: chatfunctions.dtsd
change_type: ModificationType.MODIFY
diff: @@ -32,11 +32,11 @@ chat_log() {
 	CUTSTRING=${CUTSTRING#*=}
 # Remove everything after ] to get message
 	MESSAGESTRING=${CUTSTRING%%]*}
-	echo "This was sent to chat log $@"
-	echo "This was the message $MESSAGESTRING"
-	echo "This was sender $SENDERNAME"
-	echo "This was receiver $RECEIVERNAME"
-	echo "This was receivertype $RECEIVERTYPE"
+	#echo "This was sent to chat log $@"
+	#echo "This was the message $MESSAGESTRING"
+	#echo "This was sender $SENDERNAME"
+	#echo "This was receiver $RECEIVERNAME"
+	#echo "This was receivertype $RECEIVERTYPE"
 # [CHAT is error value for SENDERNAME
 	mysql --defaults-extra-file=$CONFIGDTSD_INSTALLPATH/core/shadow.cnf -e "INSERT INTO CHATLOG (SENDER, CHATSTRING, RECIEVER) VALUES (\"$SENDERNAME\",\"$MESSAGESTRING\",\"$RECEIVERNAME\");"
 }
@@ -75,39 +75,29 @@ chat_commands() {
 		COMMANDARRAY=($MESSAGECUT)
 		USERCOMMAND=${COMMANDARRAY[0]}
 		USERCOMMAND=${USERCOMMAND^^}
+		USERCOMMAND="chatcommand_$USERCOMMAND"
 		USERPARAMETERS=${COMMANDARRAY[@]:1}
 		echo "User is $SENDERNAME"
 		echo "Command is $USERCOMMAND"
 		echo ${#USERCOMMAND}
 		echo "Parameters are $USERPARAMETERS"
-		echo "List of chat commands $CHATCOMMANDS[@]"
-		CHATCOMMANDARRAY=0
-        COMMANDFOUND=false
-		while [ -n "${CHATCOMMANDS[$CHATCOMMANDARRAY]+set}" ] 
-		do
-            CURRENTCHATCOMMAND=${CHATCOMMANDS[$CHATCOMMANDARRAY]}
-#		echo "This is the current Chat Command $CURRENTCHATCOMMAND"
-            CUTCHATCOMMAND=${CURRENTCHATCOMMAND#*_}
-#		echo "This remove chatcommand to get only the command name $CUTCHATCOMMAND"
-            if [ "$CUTCHATCOMMAND" = "$USERCOMMAND" ]
+		#echo "List of chat commands ${CHATCOMMANDS[@]}"
+		if lib_arraycontains CHATCOMMANDS $USERCOMMAND
+		then 
+			echo "Chat command found"
+		    USERCOMMAND=${USERCOMMAND#*_}
+			if check_player_rank_allowed $USERCOMMAND $SENDERNAME
             then
-                echo "Chat Command found"
-                COMMANDFOUND=true
-                if check_player_rank_allowed $USERCOMMAND $SENDERNAME
-                then
-                    eval $CURRENTCHATCOMMAND "$SENDERNAME" $USERPARAMETERS
-                else
-                    echo "Command not authorized"
-                    lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "You do not have permission to use that command!"
-                fi
-                let CHATCOMMANDARRAY++
+				USERCOMMAND="chatcommand_$USERCOMMAND"
+				$USERCOMMAND "$SENDERNAME" $USERPARAMETERS
             else
-                let CHATCOMMANDARRAY++
-            fi
-		done
-		if [ $COMMANDFOUND = false ]
-        then
-            lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "Unknown command. Please use !HELP for a list of the commands you can use"
-        fi
+				echo "Command not authorized"
+				lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "You do not have permission to use that command!"
+			fi
+        
+		else
+			echo "No matching chat command"
+			lib_screensend $CONFIGDTSD_MAINSCREEN /pm $SENDERNAME "Unknown command. Please use !HELP for a list of the commands you can use"
+		fi
 	fi	
 }
\ No newline at end of file

programming_language: Shell