-
+
Security issues of Supybot
@@ -30,6 +30,10 @@ Security issues of Supybot
3. Anyone can access network services via the bot.
I don't have example command for this, but it happens by nesting "format cut" and "misc tell".
What does this mean? Anyone can tell the bot to ghost someone else on same account, take over a channel by telling the bot to give flags (if it has correct flags), change password of the account and everything else what you do with network services.
+
4. Web page with special characters in title can be used to send DCC/CTCP commands.
+
This doesn't mean only things like CTCP actions (also known as /me), but known problems with old routers ( ) which make them reconnect to the internet.
+
This is currently* fixed only in Limnoria's testing version.
+
*See the changelog link at bottom. Currently means 17:43 (UTC) on 2012-10-31.
Are these issues publicly known?
Of course they are. They have been reported to
diff --git a/IRC/Supybot.html.md b/IRC/Supybot.html.md
index 1ba37e7..8c7c9fd 100644
--- a/IRC/Supybot.html.md
+++ b/IRC/Supybot.html.md
@@ -1,10 +1,10 @@
+
-
Security issues of Supybot
@@ -58,6 +58,16 @@ I don't have example command for this, but it happens by nesting "format cut" an
What does this mean? Anyone can tell the bot to ghost someone else on same account, take over a channel by telling the bot to give flags (if it has correct flags), change password of the account and everything else what you do with network services.
+## 4. Web page with special characters in title can be used to send DCC/CTCP commands.
+
+This doesn't mean only things like CTCP actions (also known as /me), but known problems with old routers ( ) which make
+them reconnect to the internet.
+
+This is currently* fixed only in Limnoria's testing version.
+
+*See the changelog link at bottom. Currently means 17:43 (UTC) on 2012-10-31.
+
+
# Are these issues publicly known?
Of course they are. They have been reported to