CVE-2002-0006: High severity Xchat xchat vulnerability

Published Jun 25, 2002

Updated

XChat 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allows remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING, which expands the characters in the client response when the percascii variable is set.

Affected Software

2 affected components

Xchat xchat=1.4.2

Xchat xchat=1.4.3

Remediation

Patch Available

http://www.debian.org/security/2002/dsa-099

Event History

Jun 25, 2002

CVE Published

04:00 AM

Apr 2, 2003

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-0006?

CVE-2002-0006 is considered a high severity vulnerability due to the potential for arbitrary command execution by remote attackers.

How do I fix CVE-2002-0006?

To fix CVE-2002-0006, upgrade to XChat version 1.8.8 or later, which addresses this vulnerability.

What versions of XChat are affected by CVE-2002-0006?

CVE-2002-0006 affects XChat versions 1.4.2, 1.4.3, and earlier versions.

What type of attack does CVE-2002-0006 facilitate?

CVE-2002-0006 facilitates remote command execution via manipulated PRIVMSG commands targeting users of XChat.

Is there a workaround for CVE-2002-0006 if I cannot upgrade?

A potential workaround for CVE-2002-0006 is to restrict the usage of the CTCP PING command until an upgrade can be performed.