blob: 9225bf7286923ecb7ad2aa95431ecb51ef2daa14 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200709-02">
<title>KVIrc: Remote arbitrary code execution</title>
A vulnerability has been discovered in KVIrc, allowing for the remote
execution of arbitrary code.
<product type="ebuild">kvirc</product>
<announced>September 13, 2007</announced>
<revised>September 13, 2007: 01</revised>
<package name="net-irc/kvirc" auto="yes" arch="*">
<unaffected range="ge">3.2.6_pre20070714</unaffected>
<vulnerable range="lt">3.2.6_pre20070714</vulnerable>
KVIrc is a free portable IRC client based on Qt.
Stefan Cornelius from Secunia Research discovered that the
"parseIrcUrl()" function in file src/kvirc/kernel/kvi_ircurl.cpp does
not properly sanitise parts of the URI when building the command for
KVIrc's internal script system.
<impact type="normal">
A remote attacker could entice a user to open a specially crafted
irc:// URI, possibly leading to the remote execution of arbitrary code
with the privileges of the user running KVIrc. Successful exploitation
requires that KVIrc is registered as the default handler for irc:// or
similar URIs.
There is no known workaround at this time.
All KVIrc users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=net-irc/kvirc-3.2.6_pre20070714&quot;</code>
<uri link="">CVE-2007-2951</uri>
<metadata tag="requester" timestamp="Mon, 06 Aug 2007 14:12:16 +0000">
<metadata tag="bugReady" timestamp="Sun, 19 Aug 2007 18:59:16 +0000">
<metadata tag="submitter" timestamp="Mon, 20 Aug 2007 11:26:17 +0000">