PT-2005-1233 · Kde · Konversation

Wouter Coekaerts · Published 2005-01-22 · Updated 2017-07-12 · CVE-2005-0130

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Konversation version 0.15

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in channel names or song names that are not properly quoted when the user runs IRC scripts.

Recommendations For Konversation version 0.15, consider disabling the execution of IRC scripts until a patch is available to prevent the exploitation of this issue. Restrict access to channel names and song names to minimize the risk of arbitrary command execution.

Fix

Related Identifiers

CVE-2005-0130

Affected Products

Konversation

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0130 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2005-0130 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-0130 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200501-34.xml · Vendor Advisory
• http://secunia.com/advisories/13989 · Note
• http://marc.info/?l=bugtraq&m=110626383310742&w=2 · Note
• http://kde.org/info/security/advisory-20050121-1.txt · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/031033.html · Note
• http://securitytracker.com/id?1012972 · Note
• http://secunia.com/advisories/13919 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19008 · Note
• http://securityfocus.com/bid/12312 · Note