FKIE_CVE-2007-4397

Vulnerability from fkie_nvd - Published: 2007-08-18 21:17 - Updated: 2026-06-16 22:44
Severity
Summary
Multiple CRLF injection vulnerabilities in (1) xmms-thing 1.0, (2) XMMS Remote Control Script 1.07, (3) Disrok 1.0, (4) a2x 0.0.1, (5) Another xmms-info script 1.0, (6) XChat-XMMS 0.8.1, and other unspecified scripts for XChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
References
cve@mitre.orghttp://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html
cve@mitre.orghttp://osvdb.org/39574
cve@mitre.orghttp://osvdb.org/39575
cve@mitre.orghttp://secunia.com/advisories/26454Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/26455Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/26484Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/26485Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/26486Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/26487Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/26488Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/3036
cve@mitre.orghttp://wouter.coekaerts.be/site/security/nowplaying
cve@mitre.orghttp://www.securityfocus.com/archive/1/476283/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/25281Exploit, Patch
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/35985
af854a3a-2127-422b-91ae-364da2661108http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/39574
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/39575
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26454Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26455Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26484Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26485Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26486Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26487Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26488Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/3036
af854a3a-2127-422b-91ae-364da2661108http://wouter.coekaerts.be/site/security/nowplaying
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/476283/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/25281Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/35985
Impacted products
Vendor Product Version
irssi irssi *
kristof_korwisi ixmmsa 0.3
mikachu l33t_xmms_music_showing_script 2.00
ricardo_mesquita mpg123 0.01
ricardo_mesquita ogg123 0.01
simon xmms2 1.1.3
tuomas_jormola xmmsinfo 1.1.1.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:irssi:irssi:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F2EB305-021F-4372-BC4C-8908BCE8AD49",
              "versionEndIncluding": "0.8.10rc5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kristof_korwisi:ixmmsa:0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "59D9A2F7-D84E-4BC7-A0B3-B57B6B484C6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mikachu:l33t_xmms_music_showing_script:2.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CC8728E-B801-40DE-9EE1-65F5E1DFECDB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ricardo_mesquita:mpg123:0.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "003F9C42-06E0-42D1-81EE-02DB3D6A75D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ricardo_mesquita:ogg123:0.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "E42D92F4-1AEE-42E2-B600-9EC9A1199F6B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:simon:xmms2:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8AAE787-7F3A-4098-A001-F3BA2E32E9E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tuomas_jormola:xmmsinfo:1.1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AE4C773-1512-45FC-905D-D72C64CD21E2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple CRLF injection vulnerabilities in (1) xmms-thing 1.0, (2) XMMS Remote Control Script 1.07, (3) Disrok 1.0, (4) a2x 0.0.1, (5) Another xmms-info script 1.0, (6) XChat-XMMS 0.8.1, and other unspecified scripts for XChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n CRLF en (1) xmms-thing 1.0, (2) XMMS Remote Control Script 1.07, (3) Disrok 1.0, (4) a2x 0.0.1, (5) Another xmms-info script 1.0, (6) XChat-XMMS 0.8.1, y otras secuencias de comandos no especificadas para XChat permite a atacantes remotos con la intervenci\u00f3n del usuario ejecutar comandos IRC de su elecci\u00f3n a trav\u00e9s de secuencias CRLF en el nombre de la canci\u00f3n en un archivo .mp3."
    }
  ],
  "id": "CVE-2007-4397",
  "lastModified": "2026-06-16T22:44:00.203",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2007-08-18T21:17:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/39574"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/39575"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26454"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26455"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26484"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26485"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26486"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26487"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26488"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/3036"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://wouter.coekaerts.be/site/security/nowplaying"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/476283/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/25281"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35985"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/39574"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/39575"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26454"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26455"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26484"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26485"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26486"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26487"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/26488"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/3036"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://wouter.coekaerts.be/site/security/nowplaying"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/476283/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/25281"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35985"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.