CVE-2010-2785

KVIrc 3.x-4.x - RCE

Title source: llm
STIX 2.1

Description

The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \ (backslash) characters, which allows remote authenticated users to execute arbitrary CTCP commands via vectors involving \r and \40 sequences, a different vulnerability than CVE-2010-2451 and CVE-2010-2452.

Exploits (1)

exploitdb WORKING POC VERIFIED
by unic0rn · textremotelinux
https://www.exploit-db.com/exploits/34385

References (11)

Core 11
Core References
Issue Tracking x_refsource_confirm
http://bugs.gentoo.org/show_bug.cgi?id=330111
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044643.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/40796
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/66648
Patch x_refsource_confirm
https://svn.kvirc.de/kvirc/changeset/4693
Patch mailing-list x_refsource_mlist
http://marc.info/?l=oss-security&m=128041011428629&w=2
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2010/07/28/1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/40727
Patch x_refsource_confirm
https://svn.kvirc.de/kvirc/ticket/858
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044625.html

Scores

EPSS 0.1127
EPSS Percentile 93.6%

Details

Status published
Products (6)
kvirc/kvirc 3.0.0 (3 CPE variants)
kvirc/kvirc 3.0.1
kvirc/kvirc 3.4.0
kvirc/kvirc 3.4.2 (2 CPE variants)
kvirc/kvirc 4.0.0
kvirc/kvirc 4.0.2
Published Aug 02, 2010
Tracked Since Feb 18, 2026