The remote host appears to be running a machine that has been compromised and is being controlled by a botnet.  A botnet is a network of compromised computers that are remotely controlled by a malicious bot administrator.  Botnets are commonly used for
sending spam
running Denial of Service (DoS) attacks against other networks
scanning and compromising new systems
installing sniffers
installing keyloggers
identify theft

The remote host appears to be running a machine that has installed an IRC client.  IRC is a protocol for messaging.  In many cases, IRC is used for botnet C&C traffic.

The remote host appears to be running a machine that has been compromised and is being controlled by a botnet.  A botnet is a network of compromised computers which are remotely controlled by a malicious bot administrator.  Botnets are commonly used for
sending spam
running Denial of Service (DoS) attacks against other networks
scanning and compromising new systems
Installing sniffers
Installing keyloggers
Identify theft

The remote host appears to be running a machine that has been compromised and is being controlled by a botnet.  A botnet is a network of compromised computers that are remotely controlled by a malicious bot administrator.  Botnets are commonly used for
sending spam
running Denial of Service (DoS) attacks against other networks
scanning and compromising new systems
Installing sniffers
Installing keyloggers
Identify theft

The remote host is running an IRC client, and has issued a command.

The remote host is running a Konversation, an IRC client. The remote version of this software may be vulnerable to a remote Denial of Service attack and shell code execution attack.

The remote host is running an IRC client.

The remote host is running a version of mIRC that be vulnerable to a remote Denial of Service attack. Specifically version 6.12 may be crashed if a person minimizes the DCC get dialogue windows, and then reopens those windows to get a file with an excessively long filename.  

The remote host is running the XChat IRC client. XChat IRC client versions 1.3.9 and later could allow an attacker to execute arbitrary shell commands. By embedding commands enclosed in backticks in URLs sent to XChat, a remote attacker can execute commands as the user.

The remote host is running the XChat IRC client. X-Chat versions 1.4.2 and 1.4.3 could allow a remote attacker to execute IRC commands. A remote attacker can send a specially crafted CTCP ping request to execute IRC commands on the IRC server and gain elevated privileges.

The remote host is running the XChat IRC client. X-Chat versions 1.8.8 and earlier could allow a remote attacker to execute arbitrary commands on the X-Chat client. A vulnerability regarding the lack of filtering in the EXECL command could allow an attacker to send a specially crafted /dns query that would return a malformed response from the server to execute arbitrary commands on the X-Chat client.

The remote host is running the XChat IRC client. XChat IRC client version 1.2.x is vulnerable to a format string attack. A remote attacker can create a specially crafted nickname that would cause arbitrary code to be executed on the system once a connection is established.

The remote host is running the Trillian IRC client. Trillian versions 0.73, 0.74 and possibly other versions are vulnerable to a buffer overflow, caused by improper validation of JOIN commands received from an IRC server. If a Trillian client connects to an attacker-controlled IRC server and joins a channel with a name containing more than 206 characters, the attacker could overflow a buffer and cause the victim's Trillian client to crash or execute code on the system.

The remote host is running the Trillian IRC client. Trillian version 0.73 and earlier are vulnerable to a buffer overflow in the IRC module. By operating a malicious IRC server and sending malformed responses, a remote attacker can overflow a buffer and execute code on the server. 

The remote host is running the Trillian IRC client. Trillian versions 0.725 and 0.73 are vulnerable to a format string attack in the IRC module. A remote attacker operating a malicious IRC server can deceive another user into joining a channel with a specially crafted name where malicious code can be stored. The malicious code could then be executed on the user's system, once the user joins the channel.

The remote host is running the Trillian IRC client. Trillian version 0.74 and possibly other versions are vulnerable to a Denial of Service attack, caused by improper validation of IRC raw messages. By sending one of the following raw requests: 206, 211, 213, 214, 215, 217, 218, 243, 302, 317, 324, 332, 333, 352, or 367, a remote attacker in control of a malicious IRC server could cause the victim's Trillian client to crash.

The remote host is running the Trillian IRC client. Trillian version 0.74 and possibly other versions are vulnerable to a Denial of Service attack, caused by a buffer overflow. By sending more than 4095 characters to a vulnerable Trillian client, a remote attacker in control of a malicious IRC server could overflow a buffer and cause the victim's Trillian client to crash.

The remote host is running the Trillian IRC client. Trillian versions 0.725 and 0.73 are vulnerable to a buffer overflow in the IRC module. By sending an overly long DCC chat message containing 4282 or more to another user, a remote attacker can overflow a buffer and cause the Trillian client to crash or possibly execute code on the system.

The remote host is running the Trillian IRC client. Trillian versions 0.73, 0.74, and possibly other versions are vulnerable to a buffer overflow, caused by improper validation of Internet Relay Chat (IRC) raw 221 user mode requests. By sending a raw 221 request with a mode of more than 251 bytes, a remote attacker in control of a malicious IRC server could overflow a buffer and cause the victim's Trillian client to crash or execute code on the system.

The remote host is running the Trillian IRC client. Reportedly, Trillian is prone to a Denial of Service attack when it receives messages about a user leaving a non-specified channel or a channel that the user is not currently in. It is possible to exploit this issue using a malicious server.

The remote host is running the mIRC chat client. It has been reported that it is possible to spoof file extensions in mIRC's DCC Get dialog. This could be exploited to trick a user into thinking a malicious file is safe, which may create a false sense of security and cause the user to open the file. 

The remote host is running the mIRC chat client. A buffer overflow has been reported in the $asctime identifier, a function in the mIRC scripting language. The error lies in the handling of oversized format specifier strings. Exploitation relies on a script passing untrusted input into this function. Reportedly, no such script is included in the default installation of mIRC.

The remote host is running the mIRC chat client. A vulnerability has been reported in the mIRC implementation of the DCC protocol. Reportedly, when a DCC connection is initiated, the command '100 testing' will cause the mIRC server to respond with the user's current nick. Exploitation of this vulnerability may aid an attack in further intelligent attacks, or help an attempt at social engineering.

This issue is due to improper bounds checking of nicknames sent by the server. An excessively long nickname (200+) is capable of overwriting the stack. This issue is also exploitable via a webpage that can instruct the client to launch and to make a connection to the malicious web server. This may lead to full compromise of the host running the client software on some Windows systems.

 It may be possible to crash the BitchX client when certain mode changes are made. All version up to 1.0cvs20 are affected.

The remote host is running the BitchX IRC client that may contain a backdoor. BitchX, if downloaded between 12-Apr-2003 and 13-Apr-2003, could cause a backdoor to be installed on the victim's computer. One of the FTP sites that was linked from the BitchX website was a false FTP site, and the BitchX IRC Client 1.0 c19 was modified to include a Trojan Horse. Once the Trojan Horse is executed it attempts to connect to 207.178.61.5 on port 6667. This could allow a remote attacker to gain access to systems that have installed the compromised BitchX distributions and execute commands with the privledges of the user that installed the affected package. 

Multiple vendor ircii-based client, including BitchX version 1.0c19 and possibly earlier, are vulnerable to multiple buffer overflows. A remote attacker could overflow a buffer to cause the corruption of heap memory, allowing the attacker to execute arbitrary code on the system or possibly cause the client to crash.

The remote host is running a version of the BitchX IRC client (version 75p3, 1.0c16, 1.0c19, or 1.0c20cvs) that may be vulnerable to a Denial of Service attack. If a remote attacker sends a malformed RPL_NAMEREPLY numeric 353 message to a BitchX IRC client, the attacker can cause the client to crash.

A buffer overflow within the DNS resolver code makes it possible to overwrite stack variables by generating a malformed DNS packet. A malicious attacker may use this vulnerability to execute arbitrary code in the context of the BitchX client. Note that it is necessary for an attacker to control a DNS server to exploit this bug.

The remote host is running a version of the BitchX IRC client that may be vulnerable to a format string attack. BitchX IRC clients, versions 75 up to and including 1.0c16, are vulnerable to a Denial of Service attack and possible remote execution of code. By /invite-ing someone to a channel name containing formatting characters an IRC user can cause the targeted user's BitchX client to seg-fault.  

ID	Name	Severity
4442	Generic Botnet Client Detection	critical
4440	Generic IRC Client Detection / Generic Botnet Detection	info
3858	Generic Botnet Client Detection	high
3150	Generic Botnet Client Detection (deprecated)	critical
3133	Generic Botnet Client Detection (deprecated)	critical
3132	Generic Botnet Client Detection (deprecated)	critical
3131	Generic Botnet Client Detection (deprecated)	critical
3130	Generic Botnet Client Detection (deprecated)	critical
3129	Generic Botnet Client Detection (deprecated)	critical
3128	Generic Botnet Client Detection (deprecated)	critical
3127	Generic Botnet Client Detection (deprecated)	critical
3126	Generic Botnet Client Detection (deprecated)	critical
3125	Generic Botnet Client Detection (deprecated)	critical
3124	Generic Botnet Client Detection (deprecated)	critical
3123	Generic Botnet Client Detection (deprecated)	critical
3122	Generic Botnet Client Detection (deprecated)	critical
3121	Generic Botnet Client Detection (deprecated)	high
3120	Generic Botnet Client Detection (deprecated)	critical
3119	Generic Botnet Client Detection (deprecated)	critical
3101	IRC Client Detection (NICK)	info
2547	Konversation IRC Client < 0.15.1 Multiple Remote Vulnerabilities	medium
1878	IRC Client Detection	info
1877	mIRC Minimized Dialogue Window DoS (deprecated)	medium
1876	XChat Client URL Metacharacter Command Execution	medium
1875	XChat CTCP Ping Arbitrary Remote IRC Command Execution	medium
1874	XChat /dns Reverse Lookup Response Arbitrary Command Execution	medium
1873	XChat Malformed Nickname Remote Format String	high
1872	Trillian IRC JOIN Remote Overflow	medium
1871	Trillian IRC Server Response Remote Overflow	medium
1870	Trillian IRC Module Channel Name Format String	high
1869	Trillian IRC Raw Message DoS	high
1868	Trillian IRC Oversized Data Block Remote Overflow DoS	medium
1867	Trillian IRC Module DCC Length Remote Overflow	high
1866	Trillian IRC User Mode Numeric Remote Overflow	high
1865	Trillian IRC PART Message Remote DoS	medium
1864	mIRC DCC Get Dialog File Spoofing Weakness	medium
1863	mIRC < 6.03 Scripting $asctime Overflow	medium
1862	mIRC < 6.1 DCC Server Protocol Nickname Disclosure	medium
1861	mIRC < 6.0 Long Nickname Buffer Overflow	high
1860	BitchX IRC Client Channel Mode Change DoS	high
1859	BitchX Trojaned Distribution Authentication Bypass	high
1858	Multiple ircii-based Clients Remote Overflows	medium
1857	BitchX IRC Client Malformed RPL_NAMEREPLY Message DoS	medium
1856	BitchX IRC Client DNS Response Remote Overflow	medium
1855	BitchX IRC Client "/INVITE" Command Format String DoS	high

Detections

Analytics

IRC Clients Family for Nessus Network Monitor

critical

info

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

info

medium

info

medium

medium

medium

medium

high

medium

medium

high

high

medium

high

high

medium

medium

medium

medium

high

high

high

medium

medium

medium

high