Date: Tue, 21 Jul 2009 13:38:53 -0700 From: Reed Loden <reed@...dloden.com> To: oss-security@...ts.openwall.com Subject: CVE Request -- znc Got a notice that a new znc (http://en.znc.in/wiki/ZNC) version had been released, and I saw this on the homepage (http://en.znc.in/wiki/ZNC#WARNING): ALL ZNC versions prior to 0.072 have a path traversal bug in core. Users with a valid login are able to write files to all places to which ZNC has write access. This means they could upload and load new modules which do anything imaginable. This bug is fixed in znc 0.072. Update as soon as possible! SVN log (http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1570 ) says: Fix a high-impact directory traversal bug You can upload files to znc via /dcc send *status. The files will be saved in <datadir>/users/<user>/downloads/. The code for this didn't do any checking on the file name at all and thus allowed directory traversal attacks by all znc users (no admin privileges required!). By exploiting this bug, attackers could e.g. upload a new ssh authorized_keys file or upload a znc module which lets everyone gain shell access. Anything is possible. Again: ONLY A NORMAL USER ACCOUNT NEEDED, no admin privileges. THE ATTACKER GOT WRITE ACCESS TO ALL PLACES ZNC GOT WRITE ACCESS TO. So, obviously bad... would like a CVE for it. Thanks, ~reed -- Reed Loden - <reed@...dloden.com>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.