ZNC: Privilege escalation — GLSA 201908-15

A vulnerability in ZNC allows users to escalate privileges.

Package	net-irc/znc on all architectures
Affected versions	< 1.7.4_rc1
Unaffected versions	>= 1.7.4_rc1

ZNC is an advanced IRC bouncer.

It was discovered that ZNC’s “Modules.cpp” allows remote authenticated non-admin users to escalate privileges.

A remote authenticated attacker could escalate privileges and subsequently execute arbitrary code or conduct a Denial of Service attack.

There is no known workaround at this time.

All ZNC users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-irc/znc-1.7.4_rc1"

Release date
August 15, 2019

Latest revision
August 15, 2019: 1

Severity
normal

Exploitable
remote

Bugzilla entries