XChat DNS Command Character Stripping EXECL Vulnerability
BID:4376
Info
XChat DNS Command Character Stripping EXECL Vulnerability
| Bugtraq ID: | 4376 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 27 2002 12:00AM |
| Updated: | Mar 27 2002 12:00AM |
| Credit: | Vulnerability discovery credited to Spacewalker <[email protected]>. |
| Vulnerable: |
X-Chat X-Chat 1.8.9 X-Chat X-Chat 1.8.8 X-Chat X-Chat 1.8.7 X-Chat X-Chat 1.8.6 X-Chat X-Chat 1.8.2 X-Chat X-Chat 1.8.1 X-Chat X-Chat 1.8 X-Chat X-Chat 1.7.7 X-Chat X-Chat 1.6.4 X-Chat X-Chat 1.6.3 X-Chat X-Chat 1.4.3 X-Chat X-Chat 1.4.2 X-Chat X-Chat 1.4.1 X-Chat X-Chat 1.4 X-Chat X-Chat 1.4 X-Chat X-Chat 1.3.13 X-Chat X-Chat 1.3.12 X-Chat X-Chat 1.3.11 X-Chat X-Chat 1.3.10 X-Chat X-Chat 1.3.9 X-Chat X-Chat 1.2.1 |
| Not Vulnerable: |
X-Chat X-Chat 1.8.9 |
Discussion
XChat DNS Command Character Stripping EXECL Vulnerability
XChat is a freely available, open source IRC client. It is available for the the Unix, Linux, and Microsoft Windows platforms.
XChat does not filter the response from an IRC server when a /dns query is executed. Because of the method XChat uses to resolve hostnames, by passing the configured resolver and hostname to a shell, an IRC server may return a maliciously formatted response that executes arbitrary commands with the privileges of the IRC client.
XChat is a freely available, open source IRC client. It is available for the the Unix, Linux, and Microsoft Windows platforms.
XChat does not filter the response from an IRC server when a /dns query is executed. Because of the method XChat uses to resolve hostnames, by passing the configured resolver and hostname to a shell, an IRC server may return a maliciously formatted response that executes arbitrary commands with the privileges of the IRC client.
Exploit / POC
XChat DNS Command Character Stripping EXECL Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
XChat DNS Command Character Stripping EXECL Vulnerability
Solution:
HP has advised applying the patches described in Red Hat Advisory RHSA-2002:097 to HP Secure OS.
Mandrake has released fixes.
Updates available:
X-Chat X-Chat 1.4.2
X-Chat X-Chat 1.4.3
X-Chat X-Chat 1.7.7
X-Chat X-Chat 1.8
X-Chat X-Chat 1.8.1
X-Chat X-Chat 1.8.2
X-Chat X-Chat 1.8.6
X-Chat X-Chat 1.8.7
X-Chat X-Chat 1.8.8
Solution:
HP has advised applying the patches described in Red Hat Advisory RHSA-2002:097 to HP Secure OS.
Mandrake has released fixes.
Updates available:
X-Chat X-Chat 1.4.2
-
MandrakeSoft xchat-1.8.9-1.2mdk.i586.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/7.1/RPMS/ xchat-1.8.9-1.2mdk.i586.rpm -
MandrakeSoft xchat-1.8.9-1.2mdk.i586.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/7.2/RPMS/ xchat-1.8.9-1.2mdk.i586.rpm -
MandrakeSoft xchat-1.8.9-1.2mdk.src.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/7.1/SRPMS /xchat-1.8.9-1.2mdk.src.rpm -
MandrakeSoft xchat-1.8.9-1.2mdk.src.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/7.2/SRPMS /xchat-1.8.9-1.2mdk.src.rpm
X-Chat X-Chat 1.4.3
-
Conectiva 6.0 xchat-1.8.10-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/xchat-1.8.10-1U60_1cl.i38 6.rpm -
Conectiva 6.0 xchat-1.8.10-1U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/xchat-1.8.10-1U60_1cl.sr c.rpm
X-Chat X-Chat 1.7.7
-
Conectiva 7.0 xchat-1.8.10-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/xchat-1.8.10-1U70_1cl.src .rpm -
Conectiva 7.0 xchat-gtk-1.8.10-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/xchat-gtk-1.8.10-1U70_1cl .i386.rpm
X-Chat X-Chat 1.8
-
MandrakeSoft xchat-1.8.9-1.1mdk.i586.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/8.0/RPMS/ xchat-1.8.9-1.1mdk.i586.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.ppc.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/ppc/8.0/R PMS/xchat-1.8.9-1.1mdk.ppc.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.src.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/8.0/SRPMS /xchat-1.8.9-1.1mdk.src.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.src.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/ppc/8.0/S RPMS/xchat-1.8.9-1.1mdk.src.rpm
X-Chat X-Chat 1.8.1
-
X-Chat xchat-1.8.9.tar.bz2
http://www.xchat.org/files/source/1.8/xchat-1.8.9.tar.bz2
X-Chat X-Chat 1.8.2
-
MandrakeSoft xchat-1.8.9-1.1mdk.i586.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/8.1/RPMS/ xchat-1.8.9-1.1mdk.i586.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.ia64.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/ia64/8.1/ RPMS/xchat-1.8.9-1.1mdk.ia64.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.src.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/8.1/SRPMS /xchat-1.8.9-1.1mdk.src.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.src.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/ia64/8.1/ SRPMS/xchat-1.8.9-1.1mdk.src.rpm -
X-Chat xchat-1.8.9.tar.bz2
http://www.xchat.org/files/source/1.8/xchat-1.8.9.tar.bz2
X-Chat X-Chat 1.8.6
-
X-Chat xchat-1.8.9.tar.bz2
http://www.xchat.org/files/source/1.8/xchat-1.8.9.tar.bz2
X-Chat X-Chat 1.8.7
-
Conectiva 7.0 xchat-1.8.10-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/xchat-1.8.10-1U70_1cl.i38 6.rpm -
Conectiva 7.0 xchat-1.8.10-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/xchat-1.8.10-1U70_1cl.src .rpm -
Conectiva 7.0 xchat-gtk-1.8.10-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/xchat-gtk-1.8.10-1U70_1cl .i386.rpm -
Conectiva 8.0 xchat-1.8.10-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/xchat-1.8.10-1U80_1cl.i386. rpm -
Conectiva 8.0 xchat-1.8.10-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/xchat-1.8.10-1U80_1cl.src.r pm -
Conectiva 8.0 xchat-gtk-1.8.10-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/xchat-gtk-1.8.10-1U80_1cl.i 386.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.i586.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/8.2/RPMS/ xchat-1.8.9-1.1mdk.i586.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.ppc.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/ppc/8.2/R PMS/xchat-1.8.9-1.1mdk.ppc.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.src.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/8.2/SRPMS /xchat-1.8.9-1.1mdk.src.rpm -
MandrakeSoft xchat-1.8.9-1.1mdk.src.rpm
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/ppc/8.2/S RPMS/xchat-1.8.9-1.1mdk.src.rpm -
MandrakeSoft xchat-1.8.9-1.2mdk.i586.rpm
For Corporate Server 1.0.1.
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/1.0.1/RPM S/xchat-1.8.9-1.2mdk.i586.rpm -
MandrakeSoft xchat-1.8.9-1.2mdk.src.rpm
For Corporate Server 1.0.1.
ftp://mirrors.secsup.org/pub/linux/mandrake/Mandrake/updates/1.0.1/SRP MS/xchat-1.8.9-1.2mdk.src.rpm -
Red Hat xchat-1.8.9-1.62.0.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/xchat-1.8.9-1.62.0.alpha.rpm -
Red Hat xchat-1.8.9-1.62.0.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/xchat-1.8.9-1.62.0.i386.rpm -
Red Hat xchat-1.8.9-1.62.0.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/xchat-1.8.9-1.62.0.sparc.rpm -
Red Hat xchat-1.8.9-1.62.0.src.rpm
Source RPM.
ftp://updates.redhat.com/6.2/en/os/SRPMS/xchat-1.8.9-1.62.0.src.rpm -
Red Hat xchat-1.8.9-1.70.0.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/xchat-1.8.9-1.70.0.alpha.rpm -
Red Hat xchat-1.8.9-1.70.0.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/xchat-1.8.9-1.70.0.i386.rpm -
Red Hat xchat-1.8.9-1.70.0.src.rpm
Source RPM.
ftp://updates.redhat.com/7.0/en/os/SRPMS/xchat-1.8.9-1.70.0.src.rpm -
Red Hat xchat-1.8.9-1.71.0.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/xchat-1.8.9-1.71.0.alpha.rpm -
Red Hat xchat-1.8.9-1.71.0.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/xchat-1.8.9-1.71.0.i386.rpm -
Red Hat xchat-1.8.9-1.71.0.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/xchat-1.8.9-1.71.0.ia64.rpm -
Red Hat xchat-1.8.9-1.71.0.src.rpm
Source RPM.
ftp://updates.redhat.com/7.1/en/os/SRPMS/xchat-1.8.9-1.71.0.src.rpm -
Red Hat xchat-1.8.9-1.72.0.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/xchat-1.8.9-1.72.0.i386.rpm -
Red Hat xchat-1.8.9-1.72.0.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/xchat-1.8.9-1.72.0.ia64.rpm -
Red Hat xchat-1.8.9-1.72.0.src.rpm
Source RPM.
ftp://updates.redhat.com/7.2/en/os/SRPMS/xchat-1.8.9-1.72.0.src.rpm -
Red Hat xchat-1.8.9-1.73.0.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/xchat-1.8.9-1.73.0.i386.rpm -
Red Hat xchat-1.8.9-1.73.0.src.rpm
Source RPM.
ftp://updates.redhat.com/7.3/en/os/SRPMS/xchat-1.8.9-1.73.0.src.rpm -
X-Chat xchat-1.8.9.tar.bz2
http://www.xchat.org/files/source/1.8/xchat-1.8.9.tar.bz2
X-Chat X-Chat 1.8.8
-
X-Chat xchat-1.8.9.tar.bz2
http://www.xchat.org/files/source/1.8/xchat-1.8.9.tar.bz2