Internet Relay Chat "notice" command (IRC_Notice)

About this signature or vulnerability

Proventia Network MFS, Proventia-G 1.1 and earlier, Proventia Network IDS, Proventia Network IPS, RealSecure Server Sensor, IBM Security Host Protection for Servers (Windows), Virtual Server Protection for Vmware, Proventia Server IPS for Linux technology, IBM Security Host Protection for Desktops, IBM Security Network Protection, IBM Security Host Protection for Servers (Unix):

This signature detects notice messages on Internet Relay Chat (IRC). In combination with the other IRC signatures, this signature can be used to construct a log of IRC activity.


Default risk level

Low risk vulnerability  Low

Sensors that have this signature

Proventia Network MFS: 1.0, Proventia-G 1.1 and earlier: G Series, Proventia Network IDS: A Series, Proventia Network IPS: 2.0, RealSecure Server Sensor: 7.0, IBM Security Host Protection for Servers (Windows): 2.1.14.2400, IBM Security Host Protection for Servers (Windows): 1.0.914.0, Virtual Server Protection for Vmware: 1.0, Proventia Server IPS for Linux technology: 1.0, IBM Security Host Protection for Desktops: 8.0.614.1, IBM Security Network Protection: 5.1, IBM Security Host Protection for Servers (Unix): 2.2.2

Systems affected

Jarkko Oikarinen Internet Relay Chat (IRC)

Type

Protocol Signature

Vulnerability description

Internet Relay Chat (IRC) has traditionally been used for on-line discussions. While many of IRC channels are used to discuss legitimate topics, some channels may be used to discuss illegal or unethical activities. IRC allows users to interact with each other in various ways such as actions, messages and notices. Notices, while they can also be used user-to-user, are generally used to relay informative messages to users from servers, clients scripts or robot programs.

How to remove this vulnerability

Consult your organization's acceptable use policy and consider restricting use of IRC.

References

IRCHELP.ORG
IRC Security
http://www.irchelp.org/irchelp/security/

ISS X-Force
Internet Relay Chat "notice" command
http://www.iss.net/security_center/static/9050.php