[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2018-14055: privilege escalation in ZNC
From:       Alexey Sokolov <alexey+znc () asokolov ! org>
Date:       2018-07-18 7:30:07
Message-ID: 0f1139f3-ffca-d277-5208-2c2ed5dcc3cf () asokolov ! org
[Download RAW message or body]

Severity: high

Versions affected:
1.6.0 through 1.7.0
Potentially, all earlier versions too, but there is no known way to
trigger this before 1.6.0

Mitigation:
upgrade to 1.7.1

Description:
ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming
from the network, allowing a non-admin user to escalate privilege,
inject rogue values into znc.conf, and gain shell access.

Upstream patches:
https://github.com/znc/znc/commit/a7bfbd93812950b7444841431e8e297e62cb524e
https://github.com/znc/znc/commit/d22fef8620cdd87490754f607e7153979731c69d

Reported by: Jeriko One <jeriko.one@gmx.us>

-- 
Best regards,
Alexey "DarthGandalf" Sokolov
[prev in list] [next in list] [prev in thread] [next in thread]