Short Name |
CHAT:IRC:OVERFLOW:XCHAT-SOCKS |
---|---|
Severity |
Critical |
Recommended |
No |
Recommended Action |
Drop |
Category |
CHAT |
Keywords |
XChat SOCKS 5 Buffer Overrun |
Release Date |
2004/05/19 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
This signature detects attempts to exploit a known vulnerability against an XChat client, an IRC client for UNIX. XChat versions 1.8.0 through 2.0.8 are vulnerable. Because the XChat client does not properly validate user input, an attacker can use a malicious IRC server to overflow a buffer and execute arbitrary code on the target host.
A remotely exploitable buffer overrun was reported in XChat. This issue exists in the SOCKS 5 proxy code. This stack-based buffer overrun could be exploited by a malicious proxy server if SOCKS 5 traversal has been enabled in the client. Successful exploitation will result in execution of arbitrary code as the client user. It should be noted that SOCKS 5 traversal is not enabled by default and this issue only poses a risk if the victim user deliberately connects to an attacker's SOCKS 5 proxy server.