CVE-2007-4398 - Vulnerability Details - OpenCVE

Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Irssi	Irssi

Configuration 1 [-]

cpe:2.3:a:irssi:irssi:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=7429c29a2fab6d7493c0188b5f631a7c2ae1533d
http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=76f7f7b502352ba2b823e3388a2ca88840fd1945
http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html
http://osvdb.org/39564
http://osvdb.org/39565
http://secunia.com/advisories/26457
http://secunia.com/advisories/26490
http://securityreason.com/securityalert/3036
http://wouter.coekaerts.be/site/security/nowplaying
http://www.securityfocus.com/archive/1/476283/100/0/threaded
http://www.securityfocus.com/bid/25281
https://exchange.xforce.ibmcloud.com/vulnerabilities/35985

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-08-18T21:00:00

Updated: 2024-08-07T14:53:55.859Z

Reserved: 2007-08-18T00:00:00

Link: CVE-2007-4398

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-08-18T21:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-4398

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-08-12T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "39564", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/39564"}, {"name": "25281", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/25281"}, {"name": "3036", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3036"}, {"name": "39565", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/39565"}, {"name": "20070812 Vulnerability in multiple \"now playing\" scripts for various IRC clients", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html"}, {"name": "26490", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/26490"}, {"name": "20070812 Vulnerability in multiple \"now playing\" scripts for various IRC clients", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/476283/100/0/threaded"}, {"name": "irc-multiple-command-execution(35985)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35985"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=7429c29a2fab6d7493c0188b5f631a7c2ae1533d"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=76f7f7b502352ba2b823e3388a2ca88840fd1945"}, {"name": "26457", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/26457"}, {"tags": ["x_refsource_MISC"], "url": "http://wouter.coekaerts.be/site/security/nowplaying"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-4398", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "39564", "refsource": "OSVDB", "url": "http://osvdb.org/39564"}, {"name": "25281", "refsource": "BID", "url": "http://www.securityfocus.com/bid/25281"}, {"name": "3036", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3036"}, {"name": "39565", "refsource": "OSVDB", "url": "http://osvdb.org/39565"}, {"name": "20070812 Vulnerability in multiple \"now playing\" scripts for various IRC clients", "refsource": "FULLDISC", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html"}, {"name": "26490", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/26490"}, {"name": "20070812 Vulnerability in multiple \"now playing\" scripts for various IRC clients", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/476283/100/0/threaded"}, {"name": "irc-multiple-command-execution(35985)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35985"}, {"name": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git;a=commit;h=7429c29a2fab6d7493c0188b5f631a7c2ae1533d", "refsource": "CONFIRM", "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git;a=commit;h=7429c29a2fab6d7493c0188b5f631a7c2ae1533d"}, {"name": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git;a=commit;h=76f7f7b502352ba2b823e3388a2ca88840fd1945", "refsource": "CONFIRM", "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git;a=commit;h=76f7f7b502352ba2b823e3388a2ca88840fd1945"}, {"name": "26457", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/26457"}, {"name": "http://wouter.coekaerts.be/site/security/nowplaying", "refsource": "MISC", "url": "http://wouter.coekaerts.be/site/security/nowplaying"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:53:55.859Z"}, "title": "CVE Program Container", "references": [{"name": "39564", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/39564"}, {"name": "25281", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/25281"}, {"name": "3036", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/3036"}, {"name": "39565", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/39565"}, {"name": "20070812 Vulnerability in multiple \"now playing\" scripts for various IRC clients", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html"}, {"name": "26490", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/26490"}, {"name": "20070812 Vulnerability in multiple \"now playing\" scripts for various IRC clients", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/476283/100/0/threaded"}, {"name": "irc-multiple-command-execution(35985)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35985"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=7429c29a2fab6d7493c0188b5f631a7c2ae1533d"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=76f7f7b502352ba2b823e3388a2ca88840fd1945"}, {"name": "26457", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/26457"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://wouter.coekaerts.be/site/security/nowplaying"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4398", "datePublished": "2007-08-18T21:00:00", "dateReserved": "2007-08-18T00:00:00", "dateUpdated": "2024-08-07T14:53:55.859Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:irssi:irssi:*:*:*:*:*:*:*:*", "matchCriteriaId": "3F2EB305-021F-4372-BC4C-8908BCE8AD49", "versionEndIncluding": "0.8.10rc5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n CRLF en las secuencias de comandos (1) now-playing.rb y (2) xmms.pl 1.1 para WeeChat permiten a atacantes remotos asistidos por usuario ejecutar comandos IRC arbitrarios a trav\u00e9s de secuencias CRLF en el nombre de la canci\u00f3n en un archivo .mp3."}], "id": "CVE-2007-4398", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-08-18T21:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=7429c29a2fab6d7493c0188b5f631a7c2ae1533d"}, {"source": "cve@mitre.org", "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=76f7f7b502352ba2b823e3388a2ca88840fd1945"}, {"source": "cve@mitre.org", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/39564"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/39565"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/26457"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/26490"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/3036"}, {"source": "cve@mitre.org", "url": "http://wouter.coekaerts.be/site/security/nowplaying"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/476283/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/25281"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35985"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=7429c29a2fab6d7493c0188b5f631a7c2ae1533d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://git.sv.gnu.org/gitweb/?p=weechat/scripts.git%3Ba=commit%3Bh=76f7f7b502352ba2b823e3388a2ca88840fd1945"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/39564"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/39565"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/26457"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/26490"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/3036"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://wouter.coekaerts.be/site/security/nowplaying"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/476283/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/25281"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35985"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}