Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Conectiva CLA-2003:655: BitchX multiple vulnerabilities

Conectiva CLA-2003:655: BitchX multiple vulnerabilities

by Nikola Strahija on May 26th, 2003 Several vulnerabilities have been found in BitchX which, if exploited, could allow remote attackers to issue denial-of-service attacks or to crash the client.


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------

PACKAGE : BitchX
SUMMARY : Remote vulnerabilities
DATE : 2003-05-26 14:29:00
ID : CLA-2003:655
RELEVANT
RELEASES : 6.0, 7.0, 8, 9

- -------------------------------------------------------------------------

DESCRIPTION
BitchX is a text-mode IRC client.

This update fixes two remote vulnerabilities in Bitchx:

1. Buffer overflows
In a message sent to the bugtraq mailing list, Timo Sirainen pointed
out[1] several possible buffer overflow vulnerabilities in BitchX and
other IRC clients. These vulnerabilities can be exploited by a remote
attacker who is able to control the server to which the client is
connected.

2. Denial of Service on channel mode change
A Denial of Service (DoS) vulnerability has been found[2] in BitchX.
This vulnerability allows a remote attacker to crash BitchX by
changing certains channel modes.

Please note that BitchX is being upgraded to version 1.0c18 in all
supported Conectiva Linux products, thus several new features and
other bug fixes are being added as well.


SOLUTION
All BitchX users should upgrade.


REFERENCES:
1.http://www.securityfocus.com/archive/1/315057
2.http://www.securityfocus.com/archive/1/321093
3.http://distro2.conectiva.com.br/bugzilla/show_bug.cgi?id=8197


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/BitchX-1.0c18-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/wserv-1.0c18-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/BitchX-1.0c18-1U60_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-doc-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-help-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/wserv-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/BitchX-1.0c18-1U70_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-doc-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-help-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/wserv-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/BitchX-1.0c18-17U80_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-doc-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-help-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/wserv-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/BitchX-1.0c18-29203U90_1cl.src.rpm


ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:

- run: apt-get update
- after that, execute: apt-get upgrade

Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: [email protected]
unsubscribe: [email protected]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE+0lCZ42jd0JmAcZARAghkAKDDZGejR9McoSlFT1TcYyi3aFyBzgCeLPJ/
dDmhLIwxZVeVELmT3iAPrpM=
=UuyW
-----END PGP SIGNATURE-----


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »