CVE-2007-4396 Command injection in n/a

Critical 9.3 Published 18 Aug 2007 Updated 7 Aug 2024

Remote attackers can execute arbitrary IRC commands via CRLF injection in song names, requiring user interaction to load malicious media files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2007-4396?

CVE-2007-4396 is a critical command injection vulnerability in n/a, published on 18 Aug 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple CRLF injection vulnerabilities in (1) ixmmsa.pl 0.3, (2) l33tmusic.pl 2.00, (3) mpg123.pl 0.01, (4) ogg123.pl 0.01, (5) xmms.pl 2.0, (6) xmms2.pl 1.1.3, and (7) xmmsinfo.pl 1.1.1.1 scripts for irssi before 0.8.11 allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.

Which versions are affected by CVE-2007-4396?

It affects 1 product.

Products include Irssi Irssi.

How do I fix CVE-2007-4396?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2007-4396 being exploited?

There is no known exploitation of CVE-2007-4396 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2007-4396, GHSA-9mxx-w74h-p26c.