znc.cpp in ZNC before 0.092 allows remote authenticated users to cause a denial of service (crash) by requesting traffic statistics when there is an active unauthenticated connection, which triggers a NULL pointer dereference, as demonstrated using (1) a traffic link in the web administration pages or (2) the traffic command in the /znc shell.

It was discovered that ZNC, an IRC bouncer, is vulnerable to denial of service attacks via a NULL pointer dereference when traffic statistics are requested while there is an unauthenticated connection.

Bug 603915 - znc: NULL pointer dereference flaw leads to segfault under certain conditions A Debian bug report [1] noted that ZNC would segfault under certain conditions, such as clicking 'traffic' in the webadmin pages or issuing the traffic command on the /znc shell. This has been corrected upstream [2]. This vulnerability was reported against 0.090 which is the version that Fedora provides. [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584929 [2] http://znc.svn.sourceforge.net/viewvc/znc?view=rev&revision=2026

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
47705	Debian DSA-2069-1 : znc - denial of service	Nessus	Debian Local Security Checks	low
47208	Fedora 11 : znc-0.090-2.fc11 (2010-10082)	Nessus	Fedora Local Security Checks	low
47207	Fedora 12 : znc-0.090-2.fc12 (2010-10078)	Nessus	Fedora Local Security Checks	low
47205	Fedora 13 : znc-0.090-2.fc13 (2010-10042)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2010-2448

medium

Tenable Plugins

low

low

low

low