CVE-2007-3360 - hook.c in BitchX 1.1-final allows remote IRC servers to execute arbitrary commands by sending a clie

CVE-2007-3360

Summary

hook.c in BitchX 1.1-final allows remote IRC servers to execute arbitrary commands by sending a client certain data containing NICK and EXEC strings, which exceeds the bounds of a hash table, and injects an EXEC hook function that receives and executes shell commands.

References

http://osvdb.org/37479
http://secunia.com/advisories/25759
http://secunia.com/advisories/34870
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.285737
http://www.securityfocus.com/bid/24579
https://exchange.xforce.ibmcloud.com/vulnerabilities/34969
https://www.exploit-db.com/exploits/4087

Vulnerable Configurations

cpe:2.3:a:bitchx:bitchx:1.1-final:*:*:*:*:*:*:*
cpe:2.3:a:bitchx:bitchx:1.1-final:*:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 11-10-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

refmap via4

bid	24579
exploit-db	4087
osvdb	37479
secunia	25759 34870
slackware	SSA:2009-116-02
xf	bitchx-hook-command-execution(34969)

Last major update

11-10-2017 - 01:32

Published

22-06-2007 - 18:30

Last modified

11-10-2017 - 01:32