ZNC Webadmin Module Remote Privilege Escalation Vulnerability

Bugtraq ID:	33899
Class:	Input Validation Error
CVE:	CVE-2009-0759
Remote:	Yes
Local:	No
Published:	Feb 24 2009 12:00AM
Updated:	Mar 10 2009 10:56PM
Credit:	cnu
Vulnerable:	ZNC ZNC 0.064 ZNC ZNC 0.062 ZNC ZNC 0.060 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	ZNC ZNC 0.066

ZNC Webadmin Module Remote Privilege Escalation Vulnerability

ZNC is prone to a remote privilege-escalation vulnerability.

Attackers can exploit this issue to gain administrative access to the affected application. Successful exploits will compromise the application and may lead to other attacks against the underlying computer.

Versions prior to ZNC 0.066 are affected.

ZNC Webadmin Module Remote Privilege Escalation Vulnerability

An attacker can exploit this issue using a browser.

ZNC Webadmin Module Remote Privilege Escalation Vulnerability

Solution:
The vendor released ZNC 0.066 to address this issue. Please see the references for more information.


Debian Linux 4.0 amd64

• Debian znc_0.045-3+etch2_amd64.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_a md64.deb


• Debian znc_0.058-2+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ amd64.deb

Debian Linux 4.0 ia-32

• Debian znc_0.045-3+etch2_i386.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_i 386.deb


• Debian znc_0.058-2+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ i386.deb

Debian Linux 4.0 arm

• Debian znc_0.058-2+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ arm.deb

Debian Linux 4.0 hppa

• Debian znc_0.045-3+etch2_hppa.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_h ppa.deb


• Debian znc_0.058-2+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ hppa.deb

Debian Linux 4.0 sparc

• Debian znc_0.045-3+etch2_sparc.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_s parc.deb


• Debian znc_0.058-2+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ sparc.deb

Debian Linux 4.0 s/390

• Debian znc_0.045-3+etch2_s390.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_s 390.deb


• Debian znc_0.058-2+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ s390.deb

Debian Linux 4.0 powerpc

• Debian znc_0.045-3+etch2_powerpc.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_p owerpc.deb


• Debian znc_0.058-2+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ powerpc.deb

Debian Linux 4.0 alpha

• Debian znc_0.045-3+etch2_alpha.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_a lpha.deb


• Debian znc_0.058-2+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ alpha.deb

Debian Linux 4.0 mipsel

• Debian znc_0.045-3+etch2_mipsel.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_m ipsel.deb


• Debian znc_0.058-2+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ mipsel.deb

ZNC ZNC 0.062

• ZNC znc-0.066.tar.gz
  http://downloads.sourceforge.net/znc/znc-0.066.tar.gz?use_mirror=garr

ZNC ZNC 0.060

• ZNC znc-0.066.tar.gz
  http://downloads.sourceforge.net/znc/znc-0.066.tar.gz?use_mirror=garr

ZNC ZNC 0.064

• ZNC znc-0.066.tar.gz
  http://downloads.sourceforge.net/znc/znc-0.066.tar.gz?use_mirror=garr

Debian Linux 4.0 ia-64

• Debian znc_0.045-3+etch2_ia64.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_i a64.deb


• Debian znc_0.058-2+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ ia64.deb

Debian Linux 4.0 mips

• Debian znc_0.045-3+etch2_mips.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.045-3+etch2_m ips.deb


• Debian znc_0.058-2+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/z/znc/znc_0.058-2+lenny1_ mips.deb

ZNC Webadmin Module Remote Privilege Escalation Vulnerability

References:

• ChangeLog/0.066 (ZNC)
  
• ZNC Home Page (ZNC)