CVE-2014-9403: Null Pointer Dereference
Published Dec 19, 2014
·Updated
The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by adding a channel with the same name as an existing channel but without the leading # character, related to a "use-after-delete" error.
Affected Software
1 affected component
ZNC ZNC<=1.2
Event History
Dec 19, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9403?
CVE-2014-9403 has a medium severity level due to its potential to cause denial of service.
2
How do I fix CVE-2014-9403?
To fix CVE-2014-9403, upgrade ZNC to version 1.4 or later.
3
Who is affected by CVE-2014-9403?
CVE-2014-9403 affects remote authenticated users of ZNC versions prior to 1.4.
4
What type of vulnerability is CVE-2014-9403?
CVE-2014-9403 is a denial of service vulnerability caused by a NULL pointer dereference.
5
What should I do if I cannot upgrade to fix CVE-2014-9403?
If you cannot upgrade, avoid allowing remote authenticated users to add channels without the leading # character.