ZNC: Privilege escalation

ZNC: Privilege escalation A vulnerability in ZNC allows for privilege escalation. znc March 06, 2009 March 06, 2009: 01 260148 remote 0.066 0.066

ZNC is an advanced IRC bouncer.

cnu discovered multiple CRLF injection vulnerabilities in ZNC's webadmin module.

A remote authenticated attacker could modify the znc.conf configuration file and gain privileges via newline characters in e.g. the QuitMessage field, and possibly execute arbitrary code.

There is no known workaround at this time.

All ZNC users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-irc/znc-0.066"

CVE-2009-0759 keytoaster keytoaster p-y