Detections
Analytics

Debian DSA-1744-1 : weechat - missing input sanitization

medium Nessus Plugin ID 35958

Synopsis

The remote Debian host is missing a security-related update.

Description

Sebastien Helleu discovered that an error in the handling of color codes in the weechat IRC client could cause an out-of-bounds read of an internal color array. This can be used by an attacker to crash user clients via a crafted PRIVMSG command.

The weechat version in the oldstable distribution (etch) is not affected by this problem.

Solution

Upgrade the weechat packages.

For the stable distribution (lenny), this problem has been fixed in version 0.2.6-1+lenny1.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519940

https://www.debian.org/security/2009/dsa-1744

Plugin Details

Severity: Medium

ID: 35958

File Name: debian_DSA-1744.nasl

Version: 1.14

Type: local

Agent: unix

Published: 3/19/2009

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:weechat, cpe:/o:debian:debian_linux:5.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 3/18/2009

Reference Information

CVE: CVE-2009-0661

BID: 34148

CWE: 20

DSA: 1744