PT-2007-5580 · Bitchx+1 · Bitchx+1

Publicado 2007-08-18 · Atualizado 2018-10-15 · CVE-2007-4399

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BitchX version 1.0

Description A CRLF injection issue exists, allowing user-assisted remote attackers to execute arbitrary IRC commands. This is achieved by inserting CRLF sequences in the name of a song in an .mp3 file.

Recommendations For version 1.0, consider disabling the xmms.bx script until a patch is available to prevent exploitation of this issue. Restrict access to .mp3 files with malicious song names to minimize the risk of arbitrary IRC command execution.

Exploit

Correção

Identificadores relacionados

CVE-2007-4399

Produtos afetados

Bitchx

Xmms

Referências · 9

• 🔥 http://securityfocus.com/bid/25281 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4399 · Nota de Segurança
• http://securityreason.com/securityalert/3036 · Nota
• http://securityfocus.com/archive/1/476283/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35985 · Nota
• http://wouter.coekaerts.be/site/security/nowplaying · Nota
• http://osvdb.org/37481 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html · Nota
• http://secunia.com/advisories/26489 · Aviso do Fabricante