Vulnerability Details CVE-2002-0006
XChat 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allows remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING, which expands the characters in the client response when the percascii variable is set.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.086
EPSS Ranking 91.9%
CVSS Severity
CVSS v2 Score 7.5
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000453
- http://marc.info/?l=bugtraq&m=101060676210255&w=2
- http://online.securityfocus.com/advisories/3806
- http://rhn.redhat.com/errata/RHSA-2002-005.html
- http://www.debian.org/security/2002/dsa-099
- http://www.securityfocus.com/bid/3830
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7856
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000453
- http://marc.info/?l=bugtraq&m=101060676210255&w=2
- http://online.securityfocus.com/advisories/3806
- http://rhn.redhat.com/errata/RHSA-2002-005.html
- http://www.debian.org/security/2002/dsa-099
- http://www.securityfocus.com/bid/3830
- https://exchange.xforce.ibmcloud.com/vulnerabilities/7856