Mandrake Linux Security Advisory : xchat (MDKSA-2000:039-1)

high Nessus Plugin ID 61832

Language:

Synopsis

The remote Mandrake Linux host is missing a security update.

Description

XChat 1.3.9 and later allow users to right-click on a URL appearing in an IRC discussion and select the 'Open in Browser' option. To open the URL in a browser, XChat passes the command to /bin/sh. This allows a malicious URL the ability to execute arbitrary shell commands as the user that is running XChat. This update changes the functionality of XChat to bypass the shell and execute the browser directly. Thanks go to Red Hat for providing the patch.

Update :

XChat 1.2.1 is vulnerable as well, so an update for 7.0 is now available.

Solution

Update the affected xchat package.

Plugin Details

Severity: High

ID: 61832

File Name: mandrake_MDKSA-2000-039.nasl

Version: 1.6

Type: local

Family: Mandriva Local Security Checks

Published: 9/6/2012

Updated: 1/6/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:xchat, cpe:/o:mandrakesoft:mandrake_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 8/28/2000

Reference Information

MDKSA: 2000:039-1

Detections

Analytics