BitchX security fixes

New BitchX packages are available to fix security problems found by Timo Sirainen. BitchX is an IRC Internet Relay Chat client. Under certain circumstances, a malicious IRC server could cause BitchX to crash, or possibly to run arbitrary code as the user running BitchX. All sites running BitchX a...

CVE-2003-0334

BitchX IRC client 1.0c20cvs and earlier allows attackers to cause a denial of service core dump via certain channel mode changes that are not properly handled in names.c...

[SECURITY] [DSA 298-1] New EPIC4 packages fix DoS and arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 298-1 [email protected] http://www.debian.org/security/ Martin Schulze May 2nd, 2003 http://www.debian.org/security/faq -...

DSA-287 epic - buffer overflows

Bulletin has no description...

CVE-2002-0006

Vulnerability summary (CVE-2002-0006) : XChat versions 1.8.7 and earlier (including default configurations of 1.4.2 and 1.4.3) are vulnerable. A remote attacker can execute arbitrary IRC commands as another client by sending specially encoded characters in a PRIVMSG that calls CTCP PING, which ca...

CVE-2002-1486

Multiple buffer overflows in the IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service and possibly execute arbitrary code via 1 a large response from the server, 2 a JOIN with a long channel name, 3 a long "raw 221" message, 4 a PRIVMSG with a...

CVE-2002-0382

Summary: CVE-2002-0382 affects the XChat IRC client. The issue arises when handling a /dns query, where the DNS reverse lookup can contain shell metacharacters, allowing arbitrary commands to be executed with the user’s privileges. This is caused by XChat passing the resolver/hostname to a shell ...

CVE-2002-0425

The CVE affects mIRC DCC server protocol. The vulnerability allows remote attackers to access sensitive information, specifically alternate IRC nicknames, via a "100 testing" message in a DCC connection request that the user cannot ignore or cancel. This leads to disclosure of alternate nicknames...

CVE-2002-0984

The CVE affects Light’s EPIC-based IRC script (epic4-script-light) in Light 2.7.x before 2.7.30p5 and 2.8.x before 2.8pre10. A remote attacker can trigger arbitrary code execution if a user joins a channel whose topic contains EPIC4 code, via the IRC script. Remediation involves updating to the p...

CVE-2002-1487

The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service crash by sending the raw messages 1 206, 2 211, 3 213, 4 214, 5 215, 6 217, 7 218, 8 243, 9 302, 10 317, 11 324, 12 332, 13 333, 14 352, and 15 367...

CVE-2002-0984

The IRC script included in Light 2.7.x before 2.7.30p5, and 2.8.x before 2.8pre10, running EPIC allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code...

CVE-2002-0006

XChat 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allows remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING, which expands the characters in the client response when the percascii variabl...

CVE-2002-0425

mIRC DCC server protocol allows remote attackers to gain sensitive information such as alternate IRC nicknames via a "100 testing" message in a DCC connection request that cannot be ignored or canceled by the user, which may leak the alternate nickname in a response message...

CVE-2002-1536

Molly IRC bot 0.5 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the $host variable for nslookup.pl, 2 the $to, $from, or $message variables in pop.pl, 3 the $words or $text variables in sms.pl, or 4 the $server or $printer variables in hpled.pl...

CVE-2002-1536

The CVE-2002-1536 entry concerns Molly IRC bot 0.5. Affected components are multiple Perl scripts: nslookup.pl (host variable), pop.pl (to, from, message), sms.pl (words, text), and hpled.pl (server, printer). The root cause is shell metacharacter handling in these variables, enabling a remote at...

CVE-2002-1487

The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service crash by sending the raw messages 1 206, 2 211, 3 213, 4 214, 5 215, 6 217, 7 218, 8 243, 9 302, 10 317, 11 324, 12 332, 13 333, 14 352, and 15 367...

CVE-2002-1487

The CVE-2002-1487 entry concerns the IRC component of Trillian versions 0.73 and 0.74. The vulnerability allows remote malicious IRC servers to cause a denial of service (crash) by sending any of the 15 specified raw messages (numbers 206, 211, 213, 214, 215, 217, 218, 243, 302, 317, 324, 332, 33...

CVE-2002-1536

Molly IRC bot 0.5 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the $host variable for nslookup.pl, 2 the $to, $from, or $message variables in pop.pl, 3 the $words or $text variables in sms.pl, or 4 the $server or $printer variables in hpled.pl...

CVE-2002-1488

CVE-2002-1488 affects the IRC component of Trillian in versions 0.73 and 0.74. The issue allows remote malicious IRC servers to cause a denial of service (crash) by sending a PART message with (1) a missing channel or (2) a channel that the Trillian user is not in. This is a network-vector impact...

CVE-2002-1486

CVE-2002-1486 affects Trillian's IRC component (versions 0.73 and 0.74). The issue consists of multiple buffer overflows that allow a remote IRC server to cause denial of service and potentially execute arbitrary code. Exploitation vectors include: (1) a large response from the server, (2) a JOIN...