Headline
Gentoo Linux Security Advisory 202409-23
Gentoo Linux Security Advisory 202409-23 - A vulnerability has been found in ZNC which could result in remote code execution. Versions greater than or equal to 1.9.1 are affected.
Gentoo Linux Security Advisory GLSA 202409-23
https://security.gentoo.org/
Severity: Normal
Title: ZNC: Remote Code Execution
Date: September 24, 2024
Bugs: #935422
ID: 202409-23
Synopsis
A vulnerability has been found in ZNC which could result in remote code
execution.
Background
ZNC is an advanced IRC bouncer.
Affected packages
Package Vulnerable Unaffected
net-irc/znc < 1.9.1 >= 1.9.1
Description
ZNC’s modtcl could allow for remote code execution via a KICK.
Impact
A vulnerable ZNC with the modtcl module loaded could be exploited for
remote code execution.
Workaround
Unload the mod_tcl module.
Resolution
All ZNC users should upgrade to the latest version:
emerge --sync
emerge --ask --oneshot --verbose “>=net-irc/znc-1.9.1”
References
[ 1 ] CVE-2024-39844
https://nvd.nist.gov/vuln/detail/CVE-2024-39844
Availability
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202409-23
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
Related news
Ubuntu Security Notice 6990-1 - Johannes Kuhn discovered that znc incorrectly handled user input under certain operations. An attacker could possibly use this issue to execute arbitrary code on a user's system if the user was tricked into joining a malicious server.
Debian Linux Security Advisory 5725-1 - Johannes Kuhn discovered that messages and channel names are not properly escaped in the modtcl module in ZNC, a IRC bouncer, which could result in remote code execution via specially crafted messages.