ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.

This update for znc fixes the following issues :

  - Update to version 1.7.1

  - CVE-2018-14055: non-admin user could gain admin     privileges and shell access by injecting values into     znc.conf (bnc#1101281)

  - CVE-2018-14056: path traversal in HTTP handler via ../     in a web skin name. (bnc#1101280)

  - Update to version 1.7.0

  - Make ZNC UI translateable to different languages

  - Configs written before ZNC 0.206 can't be read anymore

  - Implement IRCv3.2 capabilities away-notify,     account-notify, extended-join

  - Implement IRCv3.2 capabilities echo-message, cap-notify     on the 'client side'

  - Update capability names as they are named in IRCv3.2:
    znc.in/server-time-iso&rarr;server-time,     znc.in/batch&rarr;batch. Old names will continue working     for a while, then will be removed in some future     version.

  - Make ZNC request server-time from server when available

  - Add 'AuthOnlyViaModule' global/user setting

  - Stop defaulting real name to 'Got ZNC?'

  - Add SNI SSL client support

  - Add support for CIDR notation in allowed hosts list and     in trusted proxy list

  - Add network-specific config for cert validation in     addition to user-supplied fingerprints: TrustAllCerts,     defaults to false, and TrustPKI, defaults to true.

  - Add /attach command for symmetry with /detach. Unlike     /join it allows wildcards.

  - Update to version 1.6.6 :

  - Fix use-after-free in znc --makepem. It was broken for a     long time, but started segfaulting only now. This is a     useability fix, not a security fix, because self-signed     (or signed by a CA) certificates can be created without     using --makepem, and then combined into znc.pem.

The remote host is affected by the vulnerability described in GLSA-201807-03 (ZNC:Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in ZNC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could read arbitary files and esclate privileges.
  Workaround :

    There is no known workaround at this time.

Mitre reports :

ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.

ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.

Jeriko One discovered two vulnerabilities in the ZNC IRC bouncer which could result in privilege escalation or denial of service.

ID	Name	Product	Family	Severity
123248	openSUSE Security Update : znc (openSUSE-2019-571)	Nessus	SuSE Local Security Checks	medium
111584	openSUSE Security Update : znc (openSUSE-2018-819)	Nessus	SuSE Local Security Checks	medium
111411	GLSA-201807-03 : ZNC:Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
111180	FreeBSD : znc -- multiple vulnerabilities (c6d1a8a6-8a91-11e8-be4d-005056925db4)	Nessus	FreeBSD Local Security Checks	medium
111175	Debian DSA-4252-1 : znc - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-14056

medium

Tenable Plugins

medium

medium

medium

medium

medium