PT-2002-1113 · Xchat · Xchat

Published 2002-06-25 · Updated 2017-10-10 · CVE-2002-0006

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XChat versions 1.8.7 and earlier XChat versions 1.4.2 and 1.4.3

Description The issue allows remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING. This occurs when the percascii variable is set, causing the characters to expand in the client response.

Recommendations For XChat versions 1.8.7 and earlier, update to a version later than 1.8.7 to resolve the issue. For XChat versions 1.4.2 and 1.4.3, consider updating to a version later than 1.4.3 or modifying the default configuration to unset the percascii variable as a temporary workaround.

Exploit

Fix

Related Identifiers

CVE-2002-0006

Affected Products

Xchat

References · 9

• 🔥 https://exploit-db.com/exploits/21210 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0006 · Security Note
• http://online.securityfocus.com/advisories/3806 · Vendor Advisory
• http://debian.org/security/2002/dsa-099 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000453 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2002-005.html · Vendor Advisory
• http://securityfocus.com/bid/3830 · Note
• http://marc.info/?l=bugtraq&m=101060676210255&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7856 · Note