Bug 968562 (CVE-2013-2130)

Summary: CVE-2013-2130 znc: NULL pointer dereference in webadmin
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: affix, jlieskov, jrusnack, nb, silfreed
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130527,reported=20130529,source=gentoo,cvss2=4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P,fedora-all/znc=affected,epel-all/znc=affected,cwe=CWE-476[auto]
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-01-29 15:50:33 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 968563, 968566    
Bug Blocks:    

Description Vincent Danen 2013-05-29 16:42:43 EDT
Multiple vulnerabilities were reported in ZNC which can be exploited by malicious authenticated users to cause a denial of service.  These flaws are due to errors when handling the "editnetwork", "editchan", "addchan", and "delchan" page requests; they can be exploited to cause a NULL pointer dereference.  These flaws only affect version 1.0.

These issues have been fixed in git [1].

[1] https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28
Comment 1 Vincent Danen 2013-05-29 16:44:33 EDT
Created znc tracking bugs for this issue

Affects: fedora-all [bug 968563]
Affects: epel-all [bug 968566]
Comment 2 Jan Lieskovsky 2013-05-31 05:30:48 EDT
The CVE identifier of CVE-2013-2130 has been assigned:
  http://www.openwall.com/lists/oss-security/2013/05/30/3

to this issue.
Comment 3 Fedora Update System 2013-08-16 18:57:51 EDT
znc-1.2-0.1.alpha1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2013-08-16 19:04:50 EDT
znc-1.2-0.1.alpha1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2013-08-22 01:47:59 EDT
znc-1.2-0.1.alpha1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.