Test ID:	1.3.6.1.4.1.25623.1.0.51249
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2002:124
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory RHSA-2002:124. A security issue in XChat allows a malicious server to execute arbitrary commands. XChat is a popular cross-platform IRC client. Versions of XChat prior to 1.8.9 do not filter the response from an IRC server when a /dns query is executed. Because XChat resolves hostnames by passing the configured resolver and hostname to a shell, an IRC server may return a maliciously formatted response that executes arbitrary commands with the privileges of the user running XChat. All users of XChat are advised to update to these errata packages containing XChat version 1.8.9 which is not vulnerable to this issue. [update 14 Aug 2002] Previous packages pushed were not signed, this update replaces the packages with signed versions Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2002-124.html http://online.securityfocus.com/bid/4376/info/ Risk factor : High CVSS Score: 7.5
Cross-Ref:	BugTraq ID: 4376 Common Vulnerability Exposure (CVE) ID: CVE-2002-0382 http://www.securityfocus.com/bid/4376 Bugtraq: 20020327 Xchat /dns command execution vulnerability (Google Search) http://marc.info/?l=bugtraq&m=101725430425490&w=2 Conectiva Linux advisory: CLA-2002:526 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000526 http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-051.php http://www.redhat.com/support/errata/RHSA-2002-097.html http://www.redhat.com/support/errata/RHSA-2002-124.html http://www.iss.net/security_center/static/8704.php
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.