DESCRIPTION

A buffer overflow in the "ircii" package has been found. The "ircii" program is an internet relay chat (IRC) client. It has a feature known as DCC chat, which allows direct point-to-point communication between users, without passing through the IRC server. A buffer overflow exists in the DCC chat capability. An attacker could use this overflow to execute code as the user of ircii. Users who run "ircii" as root run the risk of a root compromise.

Note: Several other popular irc clients, including "epic" and "BitchX", are also based on the same codebase as "ircii". They are susceptible to the same vulnerability.

SOLUTION

Download the following RPM packages to the NetWinder into a temporary directory, then install them with the command "rpm -Uvh *.rpm". Be sure there are no other files ending in ".rpm" in the temporary directory. See http://www.netwinder.org/security/install.html for more help.

Required packages

http://www.netwinder.org/updates/3.1-15/armv4l/ircii-4.4M-1.armv4l.rpm

Optional packages

http://www.netwinder.org/updates/3.1-15/SRPMS/ircii-4.4M-1.src.rpm

REFERENCES