BitchX Trojaned Distribution Authentication Bypass

high Nessus Network Monitor Plugin ID 1859

Synopsis

The remote host is vulnerable to a flaw which allows for the bypassing of authentication.

Description

The remote host is running the BitchX IRC client that may contain a backdoor. BitchX, if downloaded between 12-Apr-2003 and 13-Apr-2003, could cause a backdoor to be installed on the victim's computer. One of the FTP sites that was linked from the BitchX website was a false FTP site, and the BitchX IRC Client 1.0 c19 was modified to include a Trojan Horse. Once the Trojan Horse is executed it attempts to connect to 207.178.61.5 on port 6667. This could allow a remote attacker to gain access to systems that have installed the compromised BitchX distributions and execute commands with the privledges of the user that installed the affected package.

Solution

Upgrade according to vendor recommendations.

Plugin Details

Severity: High

ID: 1859

Family: IRC Clients

Published: 8/20/2004

Updated: 3/6/2019

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:U/RC:X

Reference Information

BID: 7333

Detections

Analytics