Summary
The remote host is missing an update to znc
announced via advisory DSA 1735-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201735-1
Insight
It was discovered that znc, an IRC proxy/bouncer, does not properly sanitize input contained in configuration change requests to the webadmin interface. This allows authenticated users to elevate their privileges and indirectly execute arbitrary commands (CVE-2009-0759).
For the old stable distribution (etch), this problem has been fixed in version 0.045-3+etch2.
For the stable distribution (lenny), this problem has been fixed in version 0.058-2+lenny1.
For the unstable distribution (sid), this problem has been fixed in version 0.066-1.
We recommend that you upgrade your znc packages.
Severity
Classification
-
CVE CVE-2009-0759 -
CVSS Base Score: 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P
Related Vulnerabilities