CVE-2007-4407

View on CVE.org

Published Aug 18, 2007 CVSS 2.0 · 6.4 Medium EPSS 1.5% KEV · Not listed

Description

ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an unused channel (zannel), which allows remote attackers to (1) set or remove certain channel modes via a "netriding" attack or (2) take over a channel by joining an unlinked server with the A/Upass and then setting a new Apass.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:universal_ircd:ircu:2.10.12.03:::::::*
	cpe:2.3:a:universal_ircd:ircu:2.10.12.04:::::::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2007-4390	ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an unused channel (zannel), which allows remote attackers to (1) set or remove certain channel modes via a "netriding" attack or (2) take over a channel by joining an unlinked server with the A/Upass and then setting a new Apass.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploit prediction score: 1.5% (1.480% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
http://osvdb.org/46716
http://securityreason.com/securityalert/3031
http://www.securityfocus.com/archive/1/476285/100/0/threaded
http://www.securityfocus.com/bid/25285
https://exchange.xforce.ibmcloud.com/vulnerabilities/35989

History

No history.

Subscriptions

Universal Ircd Ircu

Weaknesses

NVD-CWE-Other

Sources

CVE record Updated: Aug 7, 2024, 2:53 PM

Status: PUBLISHED
Assigner: mitre
Published: Aug 18, 2007, 9:00 PM
Updated: Aug 7, 2024, 2:53 PM
Reserved: Aug 18, 2007, 12:00 AM

View source JSON

Vulnrichment No data

No data.

NVD Updated: Jun 16, 2026, 10:44 PM

Status: Modified
Published: Aug 18, 2007, 9:17 PM
Modified: Jun 16, 2026, 10:44 PM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-08-12T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an unused channel (zannel), which allows remote attackers to (1) set or remove certain channel modes via a \"netriding\" attack or (2) take over a channel by joining an unlinked server with the A/Upass and then setting a new Apass."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "46716", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/46716"}, {"name": "3031", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/3031"}, {"name": "20070812 Multiple vulnerabilities in ircu", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/476285/100/0/threaded"}, {"name": "25285", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/25285"}, {"name": "ircu-timestamp-unauthorized-access(35989)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35989"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-4407", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an unused channel (zannel), which allows remote attackers to (1) set or remove certain channel modes via a \"netriding\" attack or (2) take over a channel by joining an unlinked server with the A/Upass and then setting a new Apass."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "46716", "refsource": "OSVDB", "url": "http://osvdb.org/46716"}, {"name": "3031", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/3031"}, {"name": "20070812 Multiple vulnerabilities in ircu", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/476285/100/0/threaded"}, {"name": "25285", "refsource": "BID", "url": "http://www.securityfocus.com/bid/25285"}, {"name": "ircu-timestamp-unauthorized-access(35989)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35989"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:53:55.887Z"}, "title": "CVE Program Container", "references": [{"name": "46716", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/46716"}, {"name": "3031", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/3031"}, {"name": "20070812 Multiple vulnerabilities in ircu", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/476285/100/0/threaded"}, {"name": "25285", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/25285"}, {"name": "ircu-timestamp-unauthorized-access(35989)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35989"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4407", "datePublished": "2007-08-18T21:00:00.000Z", "dateReserved": "2007-08-18T00:00:00.000Z", "dateUpdated": "2024-08-07T14:53:55.887Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:universal_ircd:ircu:2.10.12.03:*:*:*:*:*:*:*", "matchCriteriaId": "F0AD3199-0273-4B7C-9DBA-C93B38A9B998", "vulnerable": true}, {"criteria": "cpe:2.3:a:universal_ircd:ircu:2.10.12.04:*:*:*:*:*:*:*", "matchCriteriaId": "B0DEFEDA-4060-4991-8B91-BE2A6690E3CE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an unused channel (zannel), which allows remote attackers to (1) set or remove certain channel modes via a \"netriding\" attack or (2) take over a channel by joining an unlinked server with the A/Upass and then setting a new Apass."}, {"lang": "es", "value": "ircu 2.10.12.03 y 2.10.12.04 no asocia una marca de tiempo con privilegio ops en un canal no utilizado (zannel), lo cual permite a atacantes remotos (1) establecer o eliminar ciertos modos de canal mediante un ataque \"netriding\" o (2) apoderarse de un canal uniendo un servidor no enlazado con el A/Upass y entonces estableciendo un nuevo Apass."}], "id": "CVE-2007-4407", "lastModified": "2026-06-16T22:44:01.417", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-08-18T21:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/46716"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/3031"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/476285/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/25285"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35989"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/46716"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/3031"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/476285/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/25285"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35989"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}