[slackware-security]  bitchx EOLed in Slackware  (SSA:2009-116-02)

This is a notice that bitchx, an IRC client based on ircii-EPIC4, has been
removed from Slackware -current and will not be part of future Slackware
releases.  Security issues and bugs have been reported, but upstream
work seems to have stalled leaving bitchx in a state where there are
known problems without official (or in some cases any) fixes.

The most secure course of action is to remove bitchx from the system and
switch to using a supported IRC client.

We have not compiled a complete list of open issues in BitchX, but here are
a few that we know about:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3360
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4584
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5839


Package removal instructions:
+---------------------------+

Remove the package as root:
# removepkg bitchx

Some admins may also want to add a symlink to another console IRC client
such as irssi to help users migrate:

cd /usr/bin
ln -sf irssi BitchX


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com