KVIrc '\r' Carriage Return in DCC Handshake Remote Command Execution Vulnerability

Bugtraq ID:	42026
Class:	Input Validation Error
CVE:	CVE-2010-2785
Remote:	Yes
Local:	No
Published:	Jul 28 2010 12:00AM
Updated:	Apr 13 2015 09:57PM
Credit:	unic0rn
Vulnerable:	S.u.S.E. openSUSE 11.3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 Pardus Linux 2009 0 KVIrc KVirc 4.0 KVIrc KVirc 3.4.2 KVIrc KVirc 3.4 KVIrc KVirc 3.2.5 KVIrc KVirc 3.2 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

KVIrc '\r' Carriage Return in DCC Handshake Remote Command Execution Vulnerability

KVIrc is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to execute arbitrary commands within the context of the affected application.

KVIrc 4.0.0 is vulnerable; other versions may also be affected.

KVIrc '\r' Carriage Return in DCC Handshake Remote Command Execution Vulnerability

The following example commands are available:

/ctcp nickname DCC GET\rQUIT\r
/ctcp nickname DCC GET\rPRIVMSG\40#channel\40:epic\40fail\r

KVIrc '\r' Carriage Return in DCC Handshake Remote Command Execution Vulnerability

Solution:
Updates are available; please see the references for more information.


Debian Linux 5.0 hppa

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_hppa.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _hppa.deb


• Debian kvirc_3.4.0-6_hppa.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_hpp a.deb

Debian Linux 5.0 ia-64

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_ia64.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _ia64.deb


• Debian kvirc_3.4.0-6_ia64.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_ia6 4.deb

Debian Linux 5.0 m68k

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb

Debian Linux 5.0 arm

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_arm.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _arm.deb


• Debian kvirc_3.4.0-6_arm.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_arm .deb

Debian Linux 5.0 armel

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_armel.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _armel.deb


• Debian kvirc_3.4.0-6_armel.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_arm el.deb

Debian Linux 5.0

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb

Debian Linux 5.0 alpha

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_alpha.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _alpha.deb


• Debian kvirc_3.4.0-6_alpha.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_alp ha.deb

Debian Linux 5.0 amd64

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_amd64.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _amd64.deb


• Debian kvirc_3.4.0-6_amd64.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_amd 64.deb

Debian Linux 5.0 ia-32

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_i386.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _i386.deb


• Debian kvirc_3.4.0-6_i386.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_i38 6.deb

Debian Linux 5.0 mips

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_mips.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _mips.deb


• Debian kvirc_3.4.0-6_mips.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_mip s.deb

Debian Linux 5.0 s/390

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_s390.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _s390.deb


• Debian kvirc_3.4.0-6_s390.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_s39 0.deb

Debian Linux 5.0 mipsel

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_mipsel.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _mipsel.deb


• Debian kvirc_3.4.0-6_mipsel.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_mip sel.deb

Debian Linux 5.0 powerpc

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_powerpc.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _powerpc.deb


• Debian kvirc_3.4.0-6_powerpc.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_pow erpc.deb

Debian Linux 5.0 sparc

• Debian kvirc-data_3.4.0-6_all.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-data_3.4.0- 6_all.deb


• Debian kvirc-dev_3.4.0-6_sparc.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc-dev_3.4.0-6 _sparc.deb


• Debian kvirc_3.4.0-6_sparc.deb
  http://security.debian.org/pool/updates/main/k/kvirc/kvirc_3.4.0-6_spa rc.deb

KVIrc '\r' Carriage Return in DCC Handshake Remote Command Execution Vulnerability

References:

• Changeset 4693 (ctrlaltca)
  
• KVirc Homepage (KVirc)
  
• Ticket #858 security issue in all versions (KVirc)