[security] 2.0.6 crashable from remote

[Peter Zelezny <zed@xchat.org>]

Due to a bug, version 2.0.6 can be crashed from remote. All users of 2.0.6
should upgrade immediately. 2.0.5 and earlier is not affected.

Explanation:
	When receiving a "passive" dcc request with an invalid ID number, the client
	will dereference NULL. As far as I know, this isn't exploitable other than
	crashing the client (it tries to write to address 0x00000008).

Cause:
	A patch accepted around Nov 18 (dcc psend patch) introduced this bug by
	neglecting to check for a NULL pointer returned from a function.
	(Don't blame me, I didn't write it! :) )

Solution:
	Work-around: /ignore *!*@* DCC
	Fix: Apply patch to 2.0.6 and recompile.
	Permanent fix: Pay me to check 3rd party patches more thoroughly.

Patch:
	http://xchat.org/files/source/2.0/xc206-fixpsend.diff


2.0.7 may follow in a few days to avoid the problem of people downloading
2.0.6 without the patch.

-- 
Peter.
--
XChat-announce:  Xchat announcement list
Archive:         http://mail.nl.linux.org/xchat-announce/