ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp.

Updated znc packages fix security vulnerabilities :

Multiple vulnerabilities were reported in ZNC version 1.0 which can be exploited by malicious authenticated users to cause a denial of service. These flaws are due to errors when handling the editnetwork, editchan, addchan, and delchan page requests; they can be exploited to cause a NULL pointer dereference (CVE-2013-2130).

Adding an already existing channel to a user/network via web admin in ZNC causes a crash if the channel name isn't prefixed with '#' (CVE-2014-9403).

The remote host is affected by the vulnerability described in GLSA-201412-31 (ZNC: Denial of Service)

    Multiple NULL pointer dereferences have been found in ZNC.
  Impact :

    A remote attacker could send a specially crafted request, possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Update to 1.2-alpha1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.2-alpha1

Fix CVE-2013-2130

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80432	Mandriva Linux Security Advisory : znc (MDVSA-2015:013)	Nessus	Mandriva Local Security Checks	medium
80109	GLSA-201412-31 : ZNC: Denial of Service	Nessus	Gentoo Local Security Checks	medium
69382	Fedora 19 : znc-1.2-0.1.alpha1.fc19 (2013-14132)	Nessus	Fedora Local Security Checks	medium
69381	Fedora 18 : znc-1.2-0.1.alpha1.fc18 (2013-14123)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-2130

medium

Tenable Plugins

medium

medium

medium

medium