X-Chat /dns query allows remote attacker to execute arbitrary commands
| xchat-dns-execute-commands (8704) |  Medium Risk |
Description:
X-Chat could allow a remote attacker to execute arbitrary commands on the X-Chat client. A vulnerability regarding the lack of filtering in the EXECL command could allow a remote attacker to send a specially-crafted /dns query that would return a malformed response from the server to execute arbitrary commands on the X-Chat client.
Platforms Affected:
- Conectiva, Linux 6.0
- Conectiva, Linux 7.0
- Conectiva, Linux 8.0
- MandrakeSoft, Mandrake Linux 7.1
- MandrakeSoft, Mandrake Linux 7.2
- MandrakeSoft, Mandrake Linux 8.0 PPC
- MandrakeSoft, Mandrake Linux 8.0
- MandrakeSoft, Mandrake Linux 8.1 IA64
- MandrakeSoft, Mandrake Linux 8.1
- MandrakeSoft, Mandrake Linux 8.2 PPC
- MandrakeSoft, Mandrake Linux 8.2
- MandrakeSoft, Mandrake Linux Corporate Server 1.0.1
- Peter Zelezny, X-Chat 1.8.8 and prior
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Linux 6.2
- RedHat, Linux 7
- RedHat, Linux 7.1
- RedHat, Linux 7.1 for iSeries
- RedHat, Linux 7.1 for pSeries
- RedHat, Linux 7.2
- RedHat, Linux 7.3
Remedy:
For Red Hat Linux:
Upgrade to the latest xcat package, as listed below. Refer to RHSA-2002:097-12 for more information. See References.
Red Hat 6.2: 1.8.9-1.62.0 or later
Red Hat 7.0: 1.8.9-1.70.0 or later
Red Hat 7.1 for iSeries and pSeries: 1.8.9-1.71.0 or later
Red Hat 7.2: 1.8.9-1.72.0 or later
Red Hat 7.3: 1.8.9-1.73.0 or later
For Mandrake Linux:
Upgrade to the latest xchat package as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:051 : xchat. See References.
Linux-Mandrake 7.1, 7.2 and Corporate Server 1.0.1 : 1.8.9-1.2mdk or later
Mandrake Linux 8.0, 8.0 (PPC), 8.1, 8.1 (IA64), 8.2 and 8.2(PPC): 1.8.9-1.1mdk or later
For Conectiva Linux:
Upgrade to the latest xchat package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2002:526 for more information. See References.
Conectiva Linux 6.0: 1.8.10-1U60_1cl or later
Conectiva Linux 7.0: 1.8.10-1U70_1cl or later
Conectiva Linux 8.0: 1.8.10-1U80_1cl or later
Consequences:
Gain Privileges
References:
- BugTraq Mailing List, Mar 27 2002 6:20PM, Xchat /dns command execution vulnerability at http://marc.theaimsgroup.com/?l=bugtraq&m=101725430425490&w=2.
- Conectiva Linux Announcement CLSA-2002:526, xchat at http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000526.
- BID-4376: XChat DNS Command Character Stripping EXECL Vulnerability
- CVE-2002-0382: XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.
- MDKSA-2002:051: Updated xchat packages fix /dns command insecurities
- RHSA-2002-097: Updated xchat packages fix "/dns" vulnerability
- RHSA-2002-124: xchat security update
Reported:
Mar 27, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net