CVE:CVE-2012-5534
CNNVD:CNNVD-201211-364
WeeChat(Wee Enhanced Environment for Chat)是一款高效的轻型IRC聊天客户端。
WeeChat 0.3.0至0.3.9.1版本中的API插件中的‘hook_process’函数中存在漏洞。远程攻击者利用该漏洞通过来自插件的命令中的shell元字符执行任意命令。与‘shell扩展’有关。
solution:Upgrade flashtux weechat to a higher version than 0.3.0,0.3.1,0.3.1.1,0.3.2,0.3.3,0.3.4,0.3.6,0.3.7,0.3.8,0.3.9,0.3.9.1,and avoid the version 0.3.0,0.3.1,0.3.1.1,0.3.2,0.3.3,0.3.4,0.3.6,0.3.7,0.3.8,0.3.9,0.3.9.1