ID de Prueba:	1.3.6.1.4.1.25623.1.0.51249
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2002:124
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2002:124. A security issue in XChat allows a malicious server to execute arbitrary commands. XChat is a popular cross-platform IRC client. Versions of XChat prior to 1.8.9 do not filter the response from an IRC server when a /dns query is executed. Because XChat resolves hostnames by passing the configured resolver and hostname to a shell, an IRC server may return a maliciously formatted response that executes arbitrary commands with the privileges of the user running XChat. All users of XChat are advised to update to these errata packages containing XChat version 1.8.9 which is not vulnerable to this issue. [update 14 Aug 2002] Previous packages pushed were not signed, this update replaces the packages with signed versions Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2002-124.html http://online.securityfocus.com/bid/4376/info/ Risk factor : High CVSS Score: 7.5
Referencia Cruzada:	BugTraq ID: 4376 Common Vulnerability Exposure (CVE) ID: CVE-2002-0382 http://www.securityfocus.com/bid/4376 Bugtraq: 20020327 Xchat /dns command execution vulnerability (Google Search) http://marc.info/?l=bugtraq&m=101725430425490&w=2 Conectiva Linux advisory: CLA-2002:526 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000526 http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-051.php http://www.redhat.com/support/errata/RHSA-2002-097.html http://www.redhat.com/support/errata/RHSA-2002-124.html http://www.iss.net/security_center/static/8704.php
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.