Arch Linux Security Advisory ASA-201807-11
=========================================
Severity: High
Date    : 2018-07-19
CVE-ID  : CVE-2018-14055 CVE-2018-14056
Package : znc
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-737

Summary
======
The package znc before version 1.7.1-1 is vulnerable to multiple issues
including privilege escalation and directory traversal.

Resolution
=========
Upgrade to 1.7.1-1.

# pacman -Syu "znc>=1.7.1-1"

The problems have been fixed upstream in version 1.7.1.

Workaround
=========
None.

Description
==========
- CVE-2018-14055 (privilege escalation)

ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming
from the network, allowing a non-admin user to escalate privilege,
inject rogue values into znc.conf, and gain shell access.

- CVE-2018-14056 (directory traversal)

ZNC before 1.7.1-rc1 is prone to a path traversal flaw. A non-admin
user can set web skin name to ../ to access files outside of the
intended skins directories and to cause DoS.

Impact
=====
An authenticated non-admin user is able to read arbitrary files, crash
the application, escalate privileges, or execute arbitrary commands on
the host.

References
=========
https://wiki.znc.in/ChangeLog/1.7.1
https://github.com/znc/znc/commit/a7bfbd93812950b7444841431e8e297e62cb524e
https://github.com/znc/znc/commit/d22fef8620cdd87490754f607e7153979731c69d
https://marc.info/?l=oss-security&m=153190583604081
https://github.com/znc/znc/commit/a4a5aeeb17d32937d8c7d743dae9a4cc755ce773
https://marc.info/?l=oss-security&m=153190593904101
https://security.archlinux.org/CVE-2018-14055
https://security.archlinux.org/CVE-2018-14056