Directory traversal vulnerability in ZNC before 0.072 allows remote attackers to overwrite arbitrary files via a crafted DCC SEND request.

It was discovered that znc, an IRC proxy, did not properly process certain DCC requests, allowing attackers to upload arbitrary files.

The remote host is affected by the vulnerability described in GLSA-200909-17 (ZNC: Directory traversal)

    The vendor reported a directory traversal vulnerability when processing     DCC SEND requests.
  Impact :

    A remote, authenticated user could send a specially crafted DCC SEND     request to overwrite arbitrary files with the privileges of the user     running ZNC, and possibly cause the execution of arbitrary code e.g. by     uploading a malicious ZNC module.
  Workaround :

    There is no known workaround at this time.

No CVE yet, one has been requested. Upgrade to 0.072 of ZNC, fixes security issue in bug 513152 An users data directory traversal flaw was found in the way ZNC used to handle file upload requests via Direct Client Connection (DCC) /dcc SEND messages. A remote IRC user could issue a /dcc SEND message with a specially crafted content (file to upload), which once accepted by a local, unsuspecting ZNC user, would overwrite relevant files in the users/<user>/downloads data directory.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
44713	Debian DSA-1848-1 : znc - directory traversal	Nessus	Debian Local Security Checks	high
40964	GLSA-200909-17 : ZNC: Directory traversal	Nessus	Gentoo Local Security Checks	high
40356	Fedora 10 : znc-0.072-3.fc10 (2009-7937)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2009-2658

high

Tenable Plugins

high

high

high