X-Chat /dns query allows remote attacker to execute arbitrary commands
| xchat-dns-execute-commands (8704) |  Medium Risk |
Description:
X-Chat could allow a remote attacker to execute arbitrary commands on the X-Chat client. A vulnerability regarding the lack of filtering in the EXECL command could allow a remote attacker to send a specially-crafted /dns query that would return a malformed response from the server to execute arbitrary commands on the X-Chat client.
Consequences:
Gain Privileges
Remedy:
For Red Hat Linux:
Upgrade to the latest xcat package, as listed below. Refer to RHSA-2002:097-12 for more information. See References.
Red Hat 6.2: 1.8.9-1.62.0 or later
Red Hat 7.0: 1.8.9-1.70.0 or later
Red Hat 7.1 for iSeries and pSeries: 1.8.9-1.71.0 or later
Red Hat 7.2: 1.8.9-1.72.0 or later
Red Hat 7.3: 1.8.9-1.73.0 or later
For Mandrake Linux:
Upgrade to the latest xchat package as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:051 : xchat. See References.
Linux-Mandrake 7.1, 7.2 and Corporate Server 1.0.1 : 1.8.9-1.2mdk or later
Mandrake Linux 8.0, 8.0 (PPC), 8.1, 8.1 (IA64), 8.2 and 8.2(PPC): 1.8.9-1.1mdk or later
For Conectiva Linux:
Upgrade to the latest xchat package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2002:526 for more information. See References.
Conectiva Linux 6.0: 1.8.10-1U60_1cl or later
Conectiva Linux 7.0: 1.8.10-1U70_1cl or later
Conectiva Linux 8.0: 1.8.10-1U80_1cl or later
References:
- BugTraq Mailing List, Mar 27 2002 6:20PM: Xchat /dns command execution vulnerability.
- Conectiva Linux Announcement CLSA-2002:526: xchat.
- BID-4376: XChat DNS Command Character Stripping EXECL Vulnerability
- CVE-2002-0382: XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.
- MDKSA-2002:051: Updated xchat packages fix /dns command insecurities
- RHSA-2002-097: Updated xchat packages fix "/dns" vulnerability
- RHSA-2002-124: xchat security update
Platforms Affected:
- Conectiva Linux 6.0
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- MandrakeSoft Mandrake Linux 7.1
- MandrakeSoft Mandrake Linux 7.2
- MandrakeSoft Mandrake Linux 8.0 PPC
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux 8.1 IA64
- MandrakeSoft Mandrake Linux 8.1
- MandrakeSoft Mandrake Linux 8.2 PPC
- MandrakeSoft Mandrake Linux 8.2
- MandrakeSoft Mandrake Linux Corporate Server 1.0.1
- Peter Zelezny X-Chat 1.8.8 and prior
- RedHat Enterprise Linux 2.1 AS
- RedHat Linux 6.2
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.1 for iSeries
- RedHat Linux 7.1 for pSeries
- RedHat Linux 7.2
- RedHat Linux 7.3
Reported:
Mar 27, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net