PT-2007-4637 · Pandemonium · Bitchx

Clarity · Publicado 2007-06-22 · Atualizado 2017-10-11 · CVE-2007-3360

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BitchX version 1.1-final

Description The issue allows remote IRC servers to execute arbitrary commands by sending specific data containing NICK and EXEC strings. This data exceeds the bounds of a hash table and injects an EXEC hook function that receives and executes shell commands.

Recommendations For BitchX version 1.1-final, consider disabling the EXEC hook function as a temporary workaround until a patch is available. Restrict access to the hash table to minimize the risk of exploitation. Avoid using the NICK and EXEC strings in the affected IRC protocol implementation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-3360

Produtos afetados

Bitchx

Referências · 8

• 🔥 https://exploit-db.com/exploits/4087 · Exploit
• http://securityfocus.com/bid/24579 · Nota
• http://secunia.com/advisories/25759 · Aviso do Fabricante
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.285737 · Aviso do Fabricante
• http://osvdb.org/37479 · Nota
• http://secunia.com/advisories/34870 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3360 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34969 · Nota