https://www.exploit-db.com/exploits/21210
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200206-079

含1.4.2版本和1.4.3版本默认配置的XChat1.8.7版本及更早版本存在漏洞。远程攻击者可以像其他客户端借助调用CTCPPING的PRIVMSG命令中的编码字符执行任意IRC命令，该漏洞在设置percascii变量时扩展客户端响应中的字符。

source: http://www.securityfocus.com/bid/3830/info

X-Chat is a graphical client for IRC. It requires the GTK+ toolkit, and is available for many Linux and Unix operating systems.

If a CTCP ping request includes escaped newline characters and additional IRC commands, these commands may be executed by the vulnerable client. It is possible to gain operator status in channels owned by the vulnerable user, or to use their identity to initiate social engineering attacks.

Although this vulnerability exists in recent versions of X-Chat, the option to expand characters has been disabled by default since version 1.4.3. 

cat 21210.exploit - | netcat server 6667 

https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/21210.exploit

来源:DEBIAN
名称:DSA-099
链接:http://www.debian.org/security/2002/dsa-099
来源:BUGTRAQ
名称:20020109xchatIRCsessionhijackingvulnerability(versions1.4.1,1.4.2)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=101060676210255&w;=2
来源:XF
名称:xchat-ctcp-ping-command(7856)
链接:http://xforce.iss.net/static/7856.php
来源:BID
名称:3830
链接:http://www.securityfocus.com/bid/3830
来源:REDHAT
名称:RHSA-2002:005
链接:http://rhn.redhat.com/errata/RHSA-2002-005.html
来源:HP
名称:HPSBTL0201-016
链接:http://online.securityfocus.com/advisories/3806
来源:CONECTIVA
名称:CLA-2002:453
链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio;=000453