PT-2002-1113 · Xchat · Xchat

Publicado 2002-06-25 · Atualizado 2017-10-10 · CVE-2002-0006

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XChat versions 1.8.7 and earlier XChat versions 1.4.2 and 1.4.3

Description The issue allows remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING. This occurs when the percascii variable is set, causing the characters to expand in the client response.

Recommendations For XChat versions 1.8.7 and earlier, update to a version later than 1.8.7 to resolve the issue. For XChat versions 1.4.2 and 1.4.3, consider updating to a version later than 1.4.3 or modifying the default configuration to unset the percascii variable as a temporary workaround.

Exploit

Correção

Identificadores relacionados

CVE-2002-0006

Produtos afetados

Xchat

Referências · 9

• 🔥 https://exploit-db.com/exploits/21210 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0006 · Nota de Segurança
• http://securityfocus.com/bid/3830 · Nota
• http://online.securityfocus.com/advisories/3806 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=101060676210255&w=2 · Nota
• http://debian.org/security/2002/dsa-099 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7856 · Nota
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000453 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2002-005.html · Aviso do Fabricante