Package: bitchx
Version: 1:1.0-0c19.20030512-2
Severity: grave
Tags: security
Justification: user security hole
During a session on IRC at #debian-devel, Md signed off with the string,
2:39 -!- Md [EMAIL PROTECTED] has quit["我的氣墊船充滿了鱔魚"]
(I also attached it in the file, just in case something got formatted
above)
Bitchx was running under LANG=C at the time. The above string caused
Bitchx to print its help screen (attached)
I'm not sure what is exactly possible here, but unprintable characters
must not be simply dumpled to the screen like this.
- Adam
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.10-1-k7
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Versions of packages bitchx depends on:
ii libc6 2.3.2.ds1-20 GNU C Library: Shared libraries an
ii libncurses5 5.4-4 Shared libraries for terminal hand
-- no debconf information
02:39 -!- Md [EMAIL PROTECTED] has quit ["æçæåèåæäéé"]
-:- Mode change [+iw] for user adamm_
-:- adamm_ [EMAIL PROTECTED] has joined #lsdkjflskjfd
-:- [Users(#lsdkjflskjfd:2)]
[ adamm_ ] [ adamm__ ]
-:- Channel #lsdkjflskjfd was created at Tue Feb 22 19:57:59 2005
-:- BitchX: Join to #lsdkjflskjfd was synched in 0.283 secs!!
<adamm__> 02:39 -!- Md [EMAIL PROTECTED] has quit ["ÃÃ
[08:32pm][adamm_(+iw)] [#lsdkjflskjfd(+nt)] ÃÂÂÃÂÃÂÃ
-:- BitchX: Help on Topic:
[window shortcuts]:
^W- - Shrinks current window 1 line
^W+ - Grows current window 1 line
^Wm - Moves current window down 1 line
^Wl - Lists current windows
^Wk - Kills current window
^Wh - Hides current window
^Wb - Balances window sizes
^Wn - Swaps to next window
^Wp - Swaps to previous window
/# - Shows window number (1-4)
Other 1 subjects: WINDOW HELP
-:- BitchX: Help on Topic:
[window shortcuts]:
^W- - Shrinks current window 1 line
^W+ - Grows current window 1 line
^Wm - Moves current window down 1 line
^Wl - Lists current windows
^Wk - Kills current window
^Wh - Hides current window
^Wb - Balances window sizes
^Wn - Swaps to next window
^Wp - Swaps to previous window
/# - Shows window number (1-4)
Other 1 subjects: WINDOW HELP
<adamm_> 1;2c1;2c
-:- Signon time : Tue Feb 22 20:32:16 2005
-:- Signoff time : Tue Feb 22 20:32:48 2005
-:- Total uptime : 0d 0h 0m 32s
-:- SignOff: adamm_ ([BX] Have you huggled your BitchX today?)
[Lag ??] [O/0 N/2 I/0 V/0 F/0]
[U:a:S:b:h]
ÃÂÂÃÂÃÂÃÂ"]
[EMAIL PROTECTED]:~$
