BugTraq
Quassel IRC: connection hijacking Oct 28 2008 11:26PM
Wouter Coekaerts (wouter coekaerts be) (1 replies)
Quassel IRC (http://quassel-irc.org/) is "a modern, cross-platform,
distributed IRC client".
A vulnerability in the CTCP handling allows an attacker to trick Quassel IRC
into sending arbitrary commands to the IRC server.
This can be used by an attacker for example to gain operator privileges on a
channel.

Details
=======
A CTCP ping where the value contains a CTCP quoted newline ('\020' + 'n') will
let the Quassel core reply with a message containing an unquoted newline
('\n'). The IRC server interprets this as a command separator.

Solution
========
This has been fixed in version 0.3.0.2, released Oct 27 2008.

Online version: http://wouter.coekaerts.be/site/security/quassel-ctcp

[ reply ]
Re: Quassel IRC: connection hijacking Oct 28 2008 11:35PM
Wouter Coekaerts (wouter coekaerts be)


 

Privacy Statement
Copyright 2010, SecurityFocus