Mandrake Linux Security Advisory : xchat (MDKSA-2000:039-1)

High Nessus Plugin ID 61832


The remote Mandrake Linux host is missing a security update.


XChat 1.3.9 and later allow users to right-click on a URL appearing in an IRC discussion and select the 'Open in Browser' option. To open the URL in a browser, XChat passes the command to /bin/sh. This allows a malicious URL the ability to execute arbitrary shell commands as the user that is running XChat. This update changes the functionality of XChat to bypass the shell and execute the browser directly. Thanks go to Red Hat for providing the patch.

Update :

XChat 1.2.1 is vulnerable as well, so an update for 7.0 is now available.


Update the affected xchat package.

Plugin Details

Severity: High

ID: 61832

File Name: mandrake_MDKSA-2000-039.nasl

Version: $Revision: 1.3 $

Type: local

Published: 2012/09/06

Modified: 2013/05/31

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:xchat, cpe:/o:mandrakesoft:mandrake_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2000/08/28

Reference Information

MDKSA: 2000:039-1