1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200903-02 / znc |
| Release Date | March 06, 2009 |
| Latest Revision | March 06, 2009: 01 |
| Impact | high |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| net-irc/znc | < 0.066 | >= 0.066 | All supported architectures |
Related bugreports: #260148
A vulnerability in ZNC allows for privilege escalation.
ZNC is an advanced IRC bouncer.
cnu discovered multiple CRLF injection vulnerabilities in ZNC's webadmin module.
A remote authenticated attacker could modify the znc.conf configuration file and gain privileges via newline characters in e.g. the QuitMessage field, and possibly execute arbitrary code.
There is no known workaround at this time.
All ZNC users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/znc-0.066" |