PT-2007-5580 · Bitchx+1 · Bitchx+1

Published 2007-08-18 · Updated 2018-10-15 · CVE-2007-4399

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BitchX version 1.0

Description A CRLF injection issue exists, allowing user-assisted remote attackers to execute arbitrary IRC commands. This is achieved by inserting CRLF sequences in the name of a song in an .mp3 file.

Recommendations For version 1.0, consider disabling the xmms.bx script until a patch is available to prevent exploitation of this issue. Restrict access to .mp3 files with malicious song names to minimize the risk of arbitrary IRC command execution.

Exploit

Fix

Related Identifiers

CVE-2007-4399

Affected Products

Bitchx

Xmms

References · 9

• 🔥 http://securityfocus.com/bid/25281 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4399 · Security Note
• http://secunia.com/advisories/26489 · Vendor Advisory
• http://securityreason.com/securityalert/3036 · Note
• http://securityfocus.com/archive/1/476283/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35985 · Note
• http://wouter.coekaerts.be/site/security/nowplaying · Note
• http://osvdb.org/37481 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html · Note