X-Chat CTCP Ping Request Escaped Newline Characters Vulnerability

vendor:

X-Chat

by:

SecurityFocus

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: X-Chat

Affected Version From: 1.4.2002

Affected Version To: 1.4.2002

Patch Exists: Yes

Related CWE: N/A

CPE: a:xchat:xchat

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux, Unix

2002

X-Chat CTCP Ping Request Escaped Newline Characters Vulnerability

X-Chat is a graphical client for IRC. It requires the GTK+ toolkit, and is available for many Linux and Unix operating systems. If a CTCP ping request includes escaped newline characters and additional IRC commands, these commands may be executed by the vulnerable client. It is possible to gain operator status in channels owned by the vulnerable user, or to use their identity to initiate social engineering attacks.

Mitigation:

Disable the option to expand characters in X-Chat since version 1.4.3.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/3830/info

X-Chat is a graphical client for IRC. It requires the GTK+ toolkit, and is available for many Linux and Unix operating systems.

If a CTCP ping request includes escaped newline characters and additional IRC commands, these commands may be executed by the vulnerable client. It is possible to gain operator status in channels owned by the vulnerable user, or to use their identity to initiate social engineering attacks.

Although this vulnerability exists in recent versions of X-Chat, the option to expand characters has been disabled by default since version 1.4.3. 

cat 21210.exploit - | netcat server 6667 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21210.exploit