Internet Relay Chat "notice" command (IRC_Notice)

About this signature or vulnerability

RealSecure Network, BlackICE, RealSecure Desktop Protector, RealSecure Server Sensor, BlackICE Server Protection, BlackICE PC Protection, RealSecure Sentry, RealSecure Guard, BlackICE Agent for Server, Proventia Network MFS, IBM Security Host Protection for Servers (Windows), Proventia-G 1.1 and earlier, Proventia Network IDS, Proventia Network IPS, IBM Security Host Protection for Desktops, RealSecure Desktop Protector 3.6, Proventia Server IPS for Linux technology, Virtual Server Protection for Vmware, IBM Security Host Protection for Servers (Unix):

This signature detects notice messages on Internet Relay Chat (IRC). In combination with the other IRC signatures, this signature can be used to construct a log of IRC activity.


Default risk level

Low risk vulnerability  Low

Sensors that have this signature

RealSecure Network: XPU 20.1, RealSecure Network: XPU 4.4, BlackICE: 3.5ebo, RealSecure Desktop Protector: 3.6, RealSecure Server Sensor: 7.0, BlackICE Server Protection: 3.6.cbd, BlackICE PC Protection: 3.6.cbd, RealSecure Sentry: 3.6, RealSecure Guard: 3.6, BlackICE Agent for Server: 3.6, Proventia Network MFS: 1.0, IBM Security Host Protection for Servers (Windows): 2.1.14.2400, IBM Security Host Protection for Servers (Windows): 1.0.914.0, Proventia-G 1.1 and earlier: G Series, Proventia Network IDS: A Series, Proventia Network IPS: 2.0, IBM Security Host Protection for Desktops: 8.0.614.1, RealSecure Desktop: baseline, RealSecure Desktop Protector 3.6: baseline, Proventia Server IPS for Linux technology: 1.0, Virtual Server Protection for Vmware: 1.0, IBM Security Host Protection for Servers (Unix): 2.2.2

Systems affected

Jarkko Oikarinen Internet Relay Chat (IRC)

Type

Protocol Signature

Vulnerability description

Internet Relay Chat (IRC) has traditionally been used for on-line discussions. While many of IRC channels are used to discuss legitimate topics, some channels may be used to discuss illegal or unethical activities. IRC allows users to interact with each other in various ways such as actions, messages and notices. Notices, while they can also be used user-to-user, are generally used to relay informative messages to users from servers, clients scripts or robot programs.

How to remove this vulnerability

Consult your organization's acceptable use policy and consider restricting use of IRC.

References

IRCHELP.ORG
IRC Security
http://www.irchelp.org/irchelp/security/

ISS X-Force
Internet Relay Chat "notice" command
http://www.iss.net/security_center/static/9050.php