CVE Request -- znc

[Reed Loden <reed () reedloden com>]

Got a notice that a new znc (http://en.znc.in/wiki/ZNC) version had  
been released,
and I saw this on the homepage (http://en.znc.in/wiki/ZNC#WARNING):
ALL ZNC versions prior to 0.072 have a path traversal bug in core.  
Users with a valid login are able to write files to all places to  
which ZNC has write access. This means they could upload and load new  
modules which do anything imaginable.

This bug is fixed in znc 0.072. Update as soon as possible!



SVN log (http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1570 
) says:

Fix a high-impact directory traversal bug
You can upload files to znc via /dcc send *status. The files will be  
saved in <datadir>/users/<user>/downloads/. The code for this didn't  
do any checking on the file name at all and thus allowed directory  
traversal attacks by all znc users (no admin privileges required!).
By exploiting this bug, attackers could e.g. upload a new ssh  
authorized_keys file or upload a znc module which lets everyone gain  
shell access. Anything is possible.
Again: ONLY A NORMAL USER ACCOUNT NEEDED, no admin privileges. THE  
ATTACKER GOT WRITE ACCESS TO ALL PLACES ZNC GOT WRITE ACCESS TO.


So, obviously bad... would like a CVE for it.

Thanks,
~reed

--
Reed Loden - <reed () reedloden com>