Lucene search

Gentoo FoundationGLSA-200404-15

HistoryApr 19, 2004 - 12:00 a.m.

XChat 2.0.x SOCKS5 Vulnerability

2004-04-1900:00:00

Gentoo Foundation

security.gentoo.org

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.231 Low

EPSS

Percentile

96.6%

JSON

Background

XChat is a multiplatform IRC client.

Description

The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker’s custom proxy server.

Impact

This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.

Workaround

A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of the affected package.

Resolution

All XChat users should upgrade to the latest stable version:

 # emerge sync
 
 # emerge -pv "&gt;=net-irc/xchat-2.0.8-r1"
 # emerge "&gt;=net-irc/xchat-2.0.8-r1"

Note that users of the gtk1 version of xchat (1.8.*) should upgrade to xchat-1.8.11-r1:

 # emerge sync
 
 # emerge -pv "=net-irc/xchat-1.8.11-r1"
 # emerge "=net-irc/xchat-1.8.11-r1"

OSVersionArchitecturePackageVersionFilename
Gentooanyallnet-irc/xchat< 2.0.8-r1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	net-irc/xchat	< 2.0.8-r1	UNKNOWN

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.231 Low

EPSS

Percentile

96.6%

JSON

Related for GLSA-200404-15