[<prev] [next>] [day] [month] [year] [list]
Message-Id: <2D641CE0-6ABC-43F5-B0A5-0EB9EFE8D7FA@reedloden.com>
Date: Tue, 21 Jul 2009 13:38:53 -0700
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request -- znc
Got a notice that a new znc (http://en.znc.in/wiki/ZNC) version had
been released,
and I saw this on the homepage (http://en.znc.in/wiki/ZNC#WARNING):
ALL ZNC versions prior to 0.072 have a path traversal bug in core.
Users with a valid login are able to write files to all places to
which ZNC has write access. This means they could upload and load new
modules which do anything imaginable.
This bug is fixed in znc 0.072. Update as soon as possible!
SVN log (http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1570
) says:
Fix a high-impact directory traversal bug
You can upload files to znc via /dcc send *status. The files will be
saved in <datadir>/users/<user>/downloads/. The code for this didn't
do any checking on the file name at all and thus allowed directory
traversal attacks by all znc users (no admin privileges required!).
By exploiting this bug, attackers could e.g. upload a new ssh
authorized_keys file or upload a znc module which lets everyone gain
shell access. Anything is possible.
Again: ONLY A NORMAL USER ACCOUNT NEEDED, no admin privileges. THE
ATTACKER GOT WRITE ACCESS TO ALL PLACES ZNC GOT WRITE ACCESS TO.
So, obviously bad... would like a CVE for it.
Thanks,
~reed
--
Reed Loden - <reed@...dloden.com>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
