CVE-2010-2812: Input Validation
An out-of-range flaw was found in znc where if it received a "PING" from a client without an argument, std::string would throw a std::outofrange exception which killed znc. This is fixed in subversion [1].
Some unsafe substr() calls were fixed as well. These are of lesser impact because a valid login is required in order to cause a std::outofrange exception. This is also fixed in subversion [2].
[1] http://znc.svn.sourceforge.net/viewvc/znc?view=revision&revision=2093 [2] http://znc.svn.sourceforge.net/viewvc/znc?view=revision&revision=2095
Other sources
Client.cpp in ZNC 0.092 allows remote attackers to cause a denial of service (exception and daemon crash) via a PING command that lacks an argument.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2812?
CVE-2010-2812 is classified as a moderate severity vulnerability due to the potential for denial of service.
How do I fix CVE-2010-2812?
To fix CVE-2010-2812, update to the patched version of ZNC that addresses this vulnerability.
What does CVE-2010-2812 affect?
CVE-2010-2812 affects ZNC version 0.092, specifically addressing an out-of-range flaw in its handling of 'PING' commands.
What is the impact of CVE-2010-2812?
The impact of CVE-2010-2812 is that it can cause ZNC to crash when it receives a specific malformed 'PING' request.
Are there any known exploits for CVE-2010-2812?
As of now, there are no widely reported exploits specifically targeting CVE-2010-2812.