KVIrc URI Handler Remote Format String Vulnerability

Bugtraq ID:	31912
Class:	Input Validation Error
CVE:	CVE-2008-4748
Remote:	Yes
Local:	No
Published:	Oct 24 2008 12:00AM
Updated:	Apr 16 2015 05:52PM
Credit:	Gjoko 'LiquidWorm' Krstic
Vulnerable:	KVIrc KVirc 3.4
Not Vulnerable:	KVIrc KVirc 3.4.2

KVIrc URI Handler Remote Format String Vulnerability

KVIrc is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.

A remote attacker may exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts may cause denial-of-service conditions.

KVIrc 3.4.0 for Microsoft Windows is vulnerable; other versions may also be affected.

KVIrc URI Handler Remote Format String Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/31912.html

KVIrc URI Handler Remote Format String Vulnerability

Solution:
An updated version is available; please see the references for more information.


KVIrc KVirc 3.4

• KVIrc KVIrc-3.4.2.exe
  For Microsoft Windows
  http://kvirc-ftp.visualscripts.com/3.4.2/binary/win32/KVIrc-3.4.2.exe

KVIrc URI Handler Remote Format String Vulnerability

References:

• KVirc Homepage (KVirc)
  
• KVIrc version 3.4.0 Virgo remote format string proof of concept exploit. (fabio )