CVE-2009-0759

EUVD-2009-0759
Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 72%
Affected Products (NVD)
VendorProductVersion
zncznc
𝑥
≤ 0.062
zncznc
0.056
zncznc
0.058
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
znc
bookworm
1.8.2-3.1+deb12u1
fixed
bookworm (security)
1.8.2-3.1+deb12u1
fixed
bullseye
1.8.2-2+deb11u1
fixed
bullseye (security)
1.8.2-2+deb11u1
fixed
sid
1.9.1-2
fixed
trixie
1.9.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
znc
dapper
dne
gutsy
ignored
hardy
ignored
intrepid
ignored
jaunty
ignored
karmic
not-affected
lucid
not-affected
maverick
not-affected
natty
not-affected
oneiric
not-affected
Common Weakness Enumeration
References
http://osvdb.org/52295
http://secunia.com/advisories/34230
http://www.debian.org/security/2009/dsa-1735
http://www.openwall.com/lists/oss-security/2009/03/01/2
http://znc.svn.sourceforge.net/viewvc/znc/trunk/modules/webadmin.cpp?view=log&sortby=rev&sortdir=down&pathrev=1395
http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1395
http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1396
http://osvdb.org/52295
http://secunia.com/advisories/34230
http://www.debian.org/security/2009/dsa-1735
http://www.openwall.com/lists/oss-security/2009/03/01/2
http://znc.svn.sourceforge.net/viewvc/znc/trunk/modules/webadmin.cpp?view=log&sortby=rev&sortdir=down&pathrev=1395
http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1395
http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1396