oss-security - CVE Request -- znc

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Tue, 21 Jul 2009 13:38:53 -0700
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request -- znc

Got a notice that a new znc (http://en.znc.in/wiki/ZNC) version had  
been released,
and I saw this on the homepage (http://en.znc.in/wiki/ZNC#WARNING):
ALL ZNC versions prior to 0.072 have a path traversal bug in core.  
Users with a valid login are able to write files to all places to  
which ZNC has write access. This means they could upload and load new  
modules which do anything imaginable.

This bug is fixed in znc 0.072. Update as soon as possible!

SVN log (http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1570 
) says:

Fix a high-impact directory traversal bug
You can upload files to znc via /dcc send *status. The files will be  
saved in <datadir>/users/<user>/downloads/. The code for this didn't  
do any checking on the file name at all and thus allowed directory  
traversal attacks by all znc users (no admin privileges required!).
By exploiting this bug, attackers could e.g. upload a new ssh  
authorized_keys file or upload a znc module which lets everyone gain  
shell access. Anything is possible.
Again: ONLY A NORMAL USER ACCOUNT NEEDED, no admin privileges. THE  
ATTACKER GOT WRITE ACCESS TO ALL PLACES ZNC GOT WRITE ACCESS TO.

So, obviously bad... would like a CVE for it.

Thanks,
~reed

--
Reed Loden - <reed@...dloden.com>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.