CVE-2005-0129

CVE-2005-0129 affects Konversation 0.15. The Quick Buttons feature allows remote attackers to cause execution of certain IRC commands via a channel name containing "%" variables, which are recursively expanded by Server::parseWildcards when the Part Button is selected. Root cause: improper handli...

CVE-2005-0131: Undefined Security Weakness

The Quick Connection dialog in Konversation 0.15 inadvertently uses the user-provided password as the nickname instead of the user-provided nickname when connecting to the IRC server, which could leak the password to other users...

CVE-2005-0129: Undefined Security Weakness

The Quick Buttons feature in Konversation 0.15 allows remote attackers to execute certain IRC commands via a channel name containing "%" variables, which are recursively expanded by the Server::parseWildcards function when the Part Button is selected...

CVE-2005-0130: Undefined Security Weakness

Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in 1 channel names or 2 song names that are not properly quoted when the user runs IRC scripts...

[Full-Disclosure] Multiple vulnerabilities in Konversation

On 18 and 19 Jan 2005 I Wouter Coekaerts discovered 3 security vulnerabilities in Konversation "A user-friendly IRC-client for KDE", http://konversation.berlios.de/. Affected are version 0.15, CVS until 18-19/01/2005, and some older versions too. They are fixed in 0.15.1. Problem 1. Quick Buttons...

Konversation IRC Client < 0.15.1 Multiple Remote Vulnerabilities

Binary data 2547.prm...

konversation -- shell script command injection

Konversation comes with Perl scripts that do not properly escape shell characters on executing a script. This makes it possible to attack Konversation with shell script command injection...