X-Chat CTCP Ping Arbitrary Remote IRC Command Execution Vulnerability

Bugtraq ID:	3830
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 09 2002 12:00AM
Updated:	Jan 09 2002 12:00AM
Credit:	Published on the BugTraq mailing list by zen-parse <[email protected]> on January 9, 2002.
Vulnerable:	X-Chat X-Chat 1.8.6 X-Chat X-Chat 1.8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 X-Chat X-Chat 1.8.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 X-Chat X-Chat 1.8 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 X-Chat X-Chat 1.7.7 X-Chat X-Chat 1.6.4 X-Chat X-Chat 1.6.3 + HP Secure OS software for Linux 1.0 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha X-Chat X-Chat 1.4.3 - OpenBSD OpenBSD 2.8 X-Chat X-Chat 1.4.2 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - HP HP-UX 11.0 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - OpenBSD OpenBSD 2.6 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha - Redhat Linux 6.2 E i386 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - Redhat Linux 6.0 - SGI IRIX 6.5 - SGI IRIX 6.4 - Slackware Linux 7.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.0 - SuSE Linux 6.4 - SuSE Linux 6.3 X-Chat X-Chat 1.4.1 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - HP HP-UX 11.0 + MandrakeSoft Corporate Server 1.0.1 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - OpenBSD OpenBSD 2.7 - OpenBSD OpenBSD 2.6 - Redhat Linux 6.2 E i386 - Redhat Linux 6.2 i386 - Redhat Linux 6.1 i386 - Redhat Linux 6.0 - SGI IRIX 6.5 - SGI IRIX 6.4 - Slackware Linux 7.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.0 - SuSE Linux 6.4 - SuSE Linux 6.3 X-Chat X-Chat 1.4 + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha
Not Vulnerable:	X-Chat X-Chat 1.8.7 + HP Secure OS software for Linux 1.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Redhat Linux 7.3 i386 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.0 sparc + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha

X-Chat CTCP Ping Arbitrary Remote IRC Command Execution Vulnerability

X-Chat is a graphical client for IRC. It requires the GTK+ toolkit, and is available for many Linux and Unix operating systems.

If a CTCP ping request includes escaped newline characters and additional IRC commands, these commands may be executed by the vulnerable client. It is possible to gain operator status in channels owned by the vulnerable user, or to use their identity to initiate social engineering attacks.

Although this vulnerability exists in recent versions of X-Chat, the option to expand characters has been disabled by default since version 1.4.3.

X-Chat CTCP Ping Arbitrary Remote IRC Command Execution Vulnerability

The following exploit has been provided by Marcus Meissner <[email protected]>:

cat xchat.exploit - | netcat server 6667

• /data/vulnerabilities/exploits/xchat.exploit

X-Chat CTCP Ping Arbitrary Remote IRC Command Execution Vulnerability

Solution:
Updated versions of X-Chat are available.


X-Chat X-Chat 1.4

• Red Hat xchat-1.8.7-1.62.0.alpha.rpm
  ftp://updates.redhat.com/6.2/en/os/alpha/xchat-1.8.7-1.62.0.alpha.rpm


• Red Hat xchat-1.8.7-1.62.0.i386.rpm
  ftp://updates.redhat.com/6.2/en/os/i386/xchat-1.8.7-1.62.0.i386.rpm


• Red Hat xchat-1.8.7-1.62.0.sparc.rpm
  ftp://updates.redhat.com/6.2/en/os/sparc/xchat-1.8.7-1.62.0.sparc.rpm


• X-Chat X-Chat 1.8.7
  http://www.xchat.org/download.html

X-Chat X-Chat 1.4.1

• Mandrake xchat-1.8.7-1.2mdk.i586.rpm
  for Mandrake 7.2
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake xchat-1.8.7-1.3mdk.i586.rpm
  for Mandrake 7.1
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake xchat-1.8.7-1.3mdk.i586.rpm
  for Mandrake Corporate Server 1.0.1
  http://www.linux-mandrake.com/en/ftp.php3


• X-Chat X-Chat 1.8.7
  http://www.xchat.org/download.html

X-Chat X-Chat 1.4.2

• Conectiva xchat-1.4.2-5U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/xchat-1.4.2-5U50_1cl.i386 .rpm


• Conectiva xchat-1.4.2-5U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/xchat-1 .4.2-5U50_1cl.i386.rpm


• Conectiva xchat-1.4.2-5U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/xchat-1. 4.2-5U50_1cl.i386.rpm


• Conectiva xchat-1.4.2-5U51_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/xchat-1.4.2-5U51_1cl.i386 .rpm


• Red Hat xchat-1.8.7-1.70.0.alpha.rpm
  ftp://updates.redhat.com/7.0/en/os/alpha/xchat-1.8.7-1.70.0.alpha.rpm


• Red Hat xchat-1.8.7-1.70.0.i386.rpm
  ftp://updates.redhat.com/7.0/en/os/i386/xchat-1.8.7-1.70.0.i386.rpm


• X-Chat X-Chat 1.8.7
  http://www.xchat.org/download.html

X-Chat X-Chat 1.4.3

• Conectiva xchat-1.4.3-8U60_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/xchat-1.4.3-8U60_1cl.i386 .rpm


• X-Chat X-Chat 1.8.7
  http://www.xchat.org/download.html

X-Chat X-Chat 1.6.3

• Red Hat xchat-1.8.7-1.71.0.alpha.rpm
  ftp://updates.redhat.com/7.1/en/os/alpha/xchat-1.8.7-1.71.0.alpha.rpm


• Red Hat xchat-1.8.7-1.71.0.i386.rpm
  ftp://updates.redhat.com/7.1/en/os/i386/xchat-1.8.7-1.71.0.i386.rpm


• Red Hat xchat-1.8.7-1.71.0.ia64.rpm
  ftp://updates.redhat.com/7.1/en/os/ia64/xchat-1.8.7-1.71.0.ia64.rpm


• X-Chat X-Chat 1.8.7
  http://www.xchat.org/download.html

X-Chat X-Chat 1.6.4

• X-Chat X-Chat 1.8.7
  http://www.xchat.org/download.html

X-Chat X-Chat 1.7.7

• Conectiva xchat-1.8.7-1U70_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/xchat-1.8.7-1U70_1cl.i386 .rpm


• Conectiva xchat-gtk-1.8.7-1U70_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/xchat-gtk-1.8.7-1U70_1cl. i386.rpm

X-Chat X-Chat 1.8

• Mandrake xchat-1.8.7-1.1mdk.i586.rpm
  for Mandrake 8.0 i586
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake xchat-1.8.7-1.1mdk.ppc.rpm
  for Mandrake 8.0 ppc
  http://www.linux-mandrake.com/en/ftp.php3

X-Chat X-Chat 1.8.1

• Red Hat xchat-1.8.7-1.72.0.i386.rpm
  ftp://updates.redhat.com/7.2/en/os/i386/xchat-1.8.7-1.72.0.i386.rpm


• Red Hat xchat-1.8.7-1.72.0.ia64.rpm
  ftp://updates.redhat.com/7.2/en/os/ia64/xchat-1.8.7-1.72.0.ia64.rpm


• X-Chat X-Chat 1.8.7
  http://www.xchat.org/download.html

X-Chat X-Chat 1.8.2

• Mandrake xchat-1.8.7-1.1mdk.i586.rpm
  for Mandrake 8.1 i586
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake xchat-1.8.7-1.1mdk.ia64.rpm
  for Mandrake 8.1 ia64
  http://www.linux-mandrake.com/en/ftp.php3

X-Chat X-Chat 1.8.6

• X-Chat X-Chat 1.8.7
  http://www.xchat.org/download.html

X-Chat CTCP Ping Arbitrary Remote IRC Command Execution Vulnerability

References:

• X-Chat (X-Chat)