PT-2016-3479 · Xchat+1 · Xchat+2

Andreyv · Published 2016-04-21 · Updated 2021-07-20 · CVE-2013-7449

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HexChat versions prior to 2.10.2 XChat (affected versions not specified) XChat-GNOME (affected versions not specified)

Description The issue is related to the ssl do connect function in common/server.c, which fails to verify that the server hostname matches a domain name in the X.509 certificate. This allows attackers to spoof SSL servers via an arbitrary valid certificate, enabling man-in-the-middle attacks.

Recommendations For HexChat versions prior to 2.10.2, update to version 2.10.2 or later. For XChat and XChat-GNOME, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-7449

Affected Products

Hexchat

Xchat

Xchat-Gnome

References · 15

• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7449 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-7449 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-7449 · Vendor Advisory
• http://hexchat.readthedocs.org/en/latest/changelog.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-7449 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7449 · Security Note
• http://ubuntu.com/usn/USN-2945-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-7449 · Vendor Advisory
• https://github.com/hexchat/hexchat/issues/524 · Note
• https://github.com/hexchat/hexchat/commit/c9b63f7f9be01692b03fa15275135a4910a7e02d · Note
• http://seclists.org/oss-sec/2016/q2/17 · Note
• https://launchpad.net/bugs/1565000 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1081839 · Note
• http://seclists.org/oss-sec/2015/q1/342 · Note