CVE-2007-4041: OS Command Injection

Published Jul 27, 2007

Updated

Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.

Affected Software

9 affected components

Microsoft Windows 2003 Server=sp2

Microsoft Windows XP=sp2

Microsoft Internet Explorer=7

Mozilla Firefox=2.0.0.5

Mozilla Firefox=3.0-alpha

Event History

Jul 27, 2007

CVE Published

10:30 PM

Data Sourced

10:30 PM

DescriptionWeaknessAffected Software

Jul 28, 2007

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4041?

CVE-2007-4041 is classified as a medium severity vulnerability allowing remote command execution.

How do I fix CVE-2007-4041?

To fix CVE-2007-4041, update Mozilla Firefox to version 3.0 or later, as the issue is resolved in subsequent releases.

What types of URIs are affected by CVE-2007-4041?

CVE-2007-4041 affects mailto, nntp, news, snews, and telnet URIs due to argument injection vulnerabilities.

Which versions of Mozilla Firefox are vulnerable to CVE-2007-4041?

Mozilla Firefox versions 2.0.0.5 and 3.0-alpha are vulnerable to CVE-2007-4041.

Can CVE-2007-4041 be exploited remotely?

Yes, CVE-2007-4041 can be exploited remotely by attackers using crafted URIs to execute arbitrary commands.