PT-2007-5577 · Irssi · L33Tmusic.Pl+7

Publicado 2007-08-18 · Atualizado 2018-10-15 · CVE-2007-4396

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions irssi versions prior to 0.8.11 ixmmsa.pl version 0.3 l33tmusic.pl version 2.00 mpg123.pl version 0.01 ogg123.pl version 0.01 xmms.pl version 2.0 xmms2.pl version 1.1.3 xmmsinfo.pl version 1.1.1.1

Description The issue allows user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file. This is due to multiple CRLF injection vulnerabilities in several scripts for irssi.

Recommendations For irssi versions prior to 0.8.11, update to version 0.8.11 or later. For ixmmsa.pl version 0.3, l33tmusic.pl version 2.00, mpg123.pl version 0.01, ogg123.pl version 0.01, xmms.pl version 2.0, xmms2.pl version 1.1.3, and xmmsinfo.pl version 1.1.1.1, consider disabling the scripts until a patch is available. As a temporary workaround, restrict the use of the vulnerable scripts to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-4396

Produtos afetados

Irssi

Ixmmsa.Pl

L33Tmusic.Pl

Mpg123.Pl

Ogg123.Pl

Xmms.Pl

Xmms2.Pl

Xmmsinfo.Pl

Referências · 12

• http://securityreason.com/securityalert/3036 · Nota
• http://securityfocus.com/bid/25281 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4396 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2007-4396 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2007-4396 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35985 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4396 · Aviso do Fabricante
• http://wouter.coekaerts.be/site/security/nowplaying · Nota
• http://securityfocus.com/archive/1/476283/100/0/threaded · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html · Nota
• http://osvdb.org/39568 · Nota
• http://secunia.com/advisories/26483 · Nota