diff options
| author | simon <simon@FreeBSD.org> | 2004-12-05 04:47:45 +0800 |
|---|---|---|
| committer | simon <simon@FreeBSD.org> | 2004-12-05 04:47:45 +0800 |
| commit | dedf1bf16031220222f4a4d89e266baa1a98d33d (patch) | |
| tree | 8fca45b91253dc0b31c5beace43eb73887ce493f | |
| parent | 87668ddcc7659fd38ef3bc93398471a733aa712c (diff) | |
| download | freebsd-ports-gnome-dedf1bf16031220222f4a4d89e266baa1a98d33d.tar.gz freebsd-ports-gnome-dedf1bf16031220222f4a4d89e266baa1a98d33d.tar.zst freebsd-ports-gnome-dedf1bf16031220222f4a4d89e266baa1a98d33d.zip | |
Document a remote code execution vulnerability in bnc.
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 6b68f47a2767..c27c22194612 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,40 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="9be819c6-4633-11d9-a9e7-0001020eed82"> + <topic>bnc -- remote code execution</topic> + <affects> + <package> + <name>bnc</name> + <range><lt>2.9.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>A LSS Security Advisory reports:</p> + <blockquote cite="http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03"> + <p>There is a buffer overflow vulnerability in + getnickuserhost() function that is called when BNC is + processing response from IRC server.</p> + <p>Vulnerability can be exploited if attacker tricks user to + connect to his fake IRC server that will exploit this + vulnerability. If the attacker has access to BNC proxy + server, this vulnerability can be used to gain shell + access on machine where BNC proxy server is set.</p> + </blockquote> + </body> + </description> + <references> + <mlist msgid="20041110131046.GA21604@cecilija.zesoi.fer.hr">http://marc.theaimsgroup.com/?l=bugtraq&m=110011817627839</mlist> + <url>http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03</url> + <url>http://www.gotbnc.com/changes.html</url> + </references> + <dates> + <discovery>2004-11-10</discovery> + <entry>2004-12-04</entry> + </dates> + </vuln> + <vuln vid="f11b219a-44b6-11d9-ae2f-021106004fd6"> <topic>rssh & scponly -- arbitrary command execution</topic> <affects> |