Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 21 Jul 2009 13:38:53 -0700
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request -- znc

Got a notice that a new znc (http://en.znc.in/wiki/ZNC) version had  
been released,
and I saw this on the homepage (http://en.znc.in/wiki/ZNC#WARNING):
ALL ZNC versions prior to 0.072 have a path traversal bug in core.  
Users with a valid login are able to write files to all places to  
which ZNC has write access. This means they could upload and load new  
modules which do anything imaginable.

This bug is fixed in znc 0.072. Update as soon as possible!



SVN log (http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1570 
) says:

Fix a high-impact directory traversal bug
You can upload files to znc via /dcc send *status. The files will be  
saved in <datadir>/users/<user>/downloads/. The code for this didn't  
do any checking on the file name at all and thus allowed directory  
traversal attacks by all znc users (no admin privileges required!).
By exploiting this bug, attackers could e.g. upload a new ssh  
authorized_keys file or upload a znc module which lets everyone gain  
shell access. Anything is possible.
Again: ONLY A NORMAL USER ACCOUNT NEEDED, no admin privileges. THE  
ATTACKER GOT WRITE ACCESS TO ALL PLACES ZNC GOT WRITE ACCESS TO.


So, obviously bad... would like a CVE for it.

Thanks,
~reed

--
Reed Loden - <reed@...dloden.com>

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.