Mail from ILUG-BOM list (Non-Digest Mode) _______________________________________________ ----- Original Message ----- From: "Raju Mathur" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Thursday, August 24, 2000 7:47 AM Subject: [LIH] (fwd) [RHSA-2000:055-03] XChat can pass URLs from IRC to a shell > [Please upgrade if you're using XChat on RedHat. Other versions of > XChat may also be vulnerable -- Raju] > > This is an RFC 1153 digest. > (1 message) > ---------------------------------------------------------------------- > > Approved-By: [EMAIL PROTECTED] > Delivered-To: [EMAIL PROTECTED] > Received: from securityfocus.com (mail.securityfocus.com [207.126.127.78]) by > lists.securityfocus.com (Postfix) with SMTP id CF35920025 for > <[EMAIL PROTECTED]>; Wed, 23 Aug 2000 09:38:03 -0700 > (PDT) > Received: (qmail 19479 invoked by alias); 23 Aug 2000 16:39:05 -0000 > Delivered-To: [EMAIL PROTECTED] > Received: (qmail 19475 invoked from network); 23 Aug 2000 16:39:04 -0000 > Received: from lacrosse.corp.redhat.com (207.175.42.154) by > mail.securityfocus.com with SMTP; 23 Aug 2000 16:39:04 -0000 > Received: from localhost (porkchop.redhat.com [207.175.42.68]) by > lacrosse.corp.redhat.com (8.9.3/8.9.3) with SMTP id MAA21529; Wed, 23 > Aug 2000 12:38:05 -0400 > Content-type: text/plain; charset="iso-8859-1" > Mime-version: 1.0 > Message-ID: <[EMAIL PROTECTED]> > Reply-To: [EMAIL PROTECTED] > X-To: [EMAIL PROTECTED] > X-cc: [EMAIL PROTECTED], [EMAIL PROTECTED] > Content-Transfer-Encoding: 8bit > X-MIME-Autoconverted: from quoted-printable to 8bit by biznetindia.com id PAA17807 > From: [EMAIL PROTECTED] > Sender: Bugtraq List <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: [RHSA-2000:055-03] XChat can pass URLs from IRC to a shell > Date: Wed, 23 Aug 2000 12:38:00 -0400 > > --------------------------------------------------------------------- > Red Hat, Inc. Security Advisory > > Synopsis: XChat can pass URLs from IRC to a shell > Advisory ID: RHSA-2000:055-03 > Issue date: 2000-08-22 > Updated on: 2000-08-23 > Product: Red Hat Linux > Keywords: XChat IRC shell > Cross references: N/A > --------------------------------------------------------------------- > > 1. Topic: > > A new XChat package is available that fixes a possible > security hole. > > 2. Relevant releases/architectures: > > Red Hat Linux 6.2 - i386, alpha, sparc > > 3. Problem description: > > XChat allows users to right-click on a URL appearing > in an IRC discussion and select "Open in Browser." To > open the URL in a browser, XChat passes it to /bin/sh. > So, a malicious URL could execute arbitrary shell commands > as the user running XChat. This errata changes XChat to > bypass the shell and execute the browser directly. > > 4. Solution: > > For each RPM for your particular architecture, run: > > rpm -Fvh [filename] > > where filename is the name of the RPM. > > 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): > > N/A > > 6. RPMs required: > > Red Hat Linux 6.2: > > sparc: > ftp://updates.redhat.com/6.2/sparc/xchat-1.4.0-2.sparc.rpm > > alpha: > ftp://updates.redhat.com/6.2/alpha/xchat-1.4.0-2.alpha.rpm > > i386: > ftp://updates.redhat.com/6.2/i386/xchat-1.4.0-2.i386.rpm > > sources: > ftp://updates.redhat.com/6.2/SRPMS/xchat-1.4.0-2.src.rpm > > 7. Verification: > > MD5 sum Package Name > -------------------------------------------------------------------------- > 0642e627980c723b64a865662b27c638 6.2/SRPMS/xchat-1.4.0-2.src.rpm > 79491287b1b683bd882f5ddcf0429018 6.2/alpha/xchat-1.4.0-2.alpha.rpm > 285f31993a4084659c38b13d3f8f9c41 6.2/i386/xchat-1.4.0-2.i386.rpm > 5878e8cd14c2aacb59ea3d05e379ca67 6.2/sparc/xchat-1.4.0-2.sparc.rpm > > These packages are GPG signed by Red Hat, Inc. for security. Our key > is available at: > http://www.redhat.com/corp/contact.html > > You can verify each package with the following command: > rpm --checksig <filename> > > If you only wish to verify that each package has not been corrupted or > tampered with, examine only the md5sum with the following command: > rpm --checksig --nogpg <filename> > > 8. References: > > Reported to BUGTRAQ by Zenith Parsec. > > > Copyright(c) 2000 Red Hat, Inc. > > ------------------------------ > > End of this Digest > ****************** > > ---------------------------------------------- > Find out more about this and other Linux India > mailing lists at http://lists.linux-india.org/ > _______________________________________________ Website: http://www.ilug-bom.org.in/ Linuxers mailing list [EMAIL PROTECTED] http://ilug-bom.org.in/mailman/listinfo/linuxers
