PT-2003-1527 · Bitchx · Bitchx Irc Client

Timo Sirainen · Published 2003-05-22 · Updated 2016-10-18 · CVE-2003-0321

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: BitchX IRC client versions 1.0-0c19 and earlier

Description: The issue is related to multiple buffer overflows that can be triggered by remote malicious IRC servers. These overflows occur when the client encounters long hostnames, nicknames, or channel names that are not properly handled by certain functions, including send ctcp, cannot join channel, cluster, BX compress modes, handle oper vision, and ban it. This can lead to a denial of service (crash) and potentially allow the execution of arbitrary code.

Recommendations: For BitchX IRC client versions 1.0-0c19 and earlier, consider disabling the functions send ctcp, cannot join channel, cluster, BX compress modes, handle oper vision, and ban it as a temporary workaround until a patch is available. Restrict access to the client to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2003-0321

DSA-306

Affected Products

Bitchx Irc Client

References · 10

• http://security.debian.org/pool/updates/main/i/ircii-pana/ircii-pana_1.0-0c16-2.1.diff.gz · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2003-0321 · Security Note
• http://debian.org/security/2003/dsa-306 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000655 · Vendor Advisory
• http://securityfocus.com/bid/7096 · Note
• http://securityfocus.com/bid/7097 · Note
• http://marc.info/?l=bugtraq&m=104766521328322&w=2 · Note
• http://marc.info/?l=bugtraq&m=104852615211913&w=2 · Note
• http://securityfocus.com/bid/7099 · Note
• http://securityfocus.com/bid/7100 · Note