PT-2007-4637 · Pandemonium · Bitchx

Clarity · Published 2007-06-22 · Updated 2017-10-11 · CVE-2007-3360

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BitchX version 1.1-final

Description The issue allows remote IRC servers to execute arbitrary commands by sending specific data containing NICK and EXEC strings. This data exceeds the bounds of a hash table and injects an EXEC hook function that receives and executes shell commands.

Recommendations For BitchX version 1.1-final, consider disabling the EXEC hook function as a temporary workaround until a patch is available. Restrict access to the hash table to minimize the risk of exploitation. Avoid using the NICK and EXEC strings in the affected IRC protocol implementation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-3360

Affected Products

Bitchx

References · 8

• 🔥 https://exploit-db.com/exploits/4087 · Exploit
• http://secunia.com/advisories/25759 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.285737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3360 · Security Note
• http://securityfocus.com/bid/24579 · Note
• http://osvdb.org/37479 · Note
• http://secunia.com/advisories/34870 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34969 · Note