CHAT: XChat SOCKS 5 Buffer Overrun

This signature detects attempts to exploit a known vulnerability against an XChat client, an IRC client for UNIX. XChat versions 1.8.0 through 2.0.8 are vulnerable. Because the XChat client does not properly validate user input, an attacker can use a malicious IRC server to overflow a buffer and execute arbitrary code on the target host.

Extended Description

A remotely exploitable buffer overrun was reported in XChat. This issue exists in the SOCKS 5 proxy code. This stack-based buffer overrun could be exploited by a malicious proxy server if SOCKS 5 traversal has been enabled in the client. Successful exploitation will result in execution of arbitrary code as the client user. It should be noted that SOCKS 5 traversal is not enabled by default and this issue only poses a risk if the victim user deliberately connects to an attacker's SOCKS 5 proxy server.

Affected Products

X-chat x-chat

References

BugTraq: 10168

CVE: CVE-2004-0409

URL: http://www.redhat.com/support/errata/RHSA-2004-177.html http://www.xchat.org/

Short Name

CHAT:IRC:OVERFLOW:XCHAT-SOCKS

Severity

Critical

Recommended

False

Recommended Action

Drop

CHAT: XChat SOCKS 5 Buffer Overrun

Extended Description

Affected Products

References

Found a potential security threat?