REDHAT-BUG-622600: High severity ZNC ZNC vulnerability
An out-of-range flaw was found in znc where if it received a "PING" from a client without an argument, std::string would throw a std::outofrange exception which killed znc. This is fixed in subversion [1].
Some unsafe substr() calls were fixed as well. These are of lesser impact because a valid login is required in order to cause a std::outofrange exception. This is also fixed in subversion [2].
[1] http://znc.svn.sourceforge.net/viewvc/znc?view=revision&revision=2093 [2] http://znc.svn.sourceforge.net/viewvc/znc?view=revision&revision=2095
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-622600?
The severity of REDHAT-BUG-622600 is considered moderate due to the denial of service caused by an out-of-range exception that can crash the ZNC service.
How do I fix REDHAT-BUG-622600?
To fix REDHAT-BUG-622600, update to the latest version of ZNC that includes the patch for the out-of-range flaw.
What versions of ZNC are affected by REDHAT-BUG-622600?
ZNC versions prior to 2093 are affected by REDHAT-BUG-622600.
What is the nature of the vulnerability in REDHAT-BUG-622600?
The vulnerability in REDHAT-BUG-622600 is an out-of-range error triggered by a malformed "PING" command, resulting in a service crash.
Are there any additional vulnerabilities fixed alongside REDHAT-BUG-622600?
Yes, REDHAT-BUG-622600 also addresses other unsafe substr() calls within ZNC that have a lesser impact.