Bug 398159 – <net-irc/znc-0.202-r1 : Denial of Service (CVE-2012-0033)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sean Amoss (RETIRED) 2012-01-08 15:57:26 UTC]

From CVE request at $URL:

please assign a CVE ID to a DoS issue in the ZNC IRC bouncer.

I don't have a upstream reference, but the upstream patch applied 
by the Debian maintainer can be found here:

http://patch-tracker.debian.org/patch/series/view/znc/0.202-2/01-fix-bouncedcc-dos.diff 
http://packages.qa.debian.org/z/znc/news/20120107T145601Z.html

[Comment 1 Agostino Sarubbo 2012-01-08 16:11:50 UTC]

from commit:

Affected ZNC versions: 0.200, 0.202.

probably here it should be ~3 ?

[Comment 2 Sean Amoss (RETIRED) 2012-01-08 16:38:48 UTC]

Indeed, 0.9.4 does not include bouncedcc module.

[Comment 3 Alex Alexander (RETIRED) 2012-01-08 18:20:18 UTC]

patch applied in znc-0.202-r1
old ebuild removed.

upstream reference: http://sprunge.us/TAGd

thanks :)

[Comment 4 Alex Alexander (RETIRED) 2012-01-08 18:29:57 UTC]

real upstream reference:
https://github.com/znc/znc/commit/11508aa72efab4fad0dbd8292b9614d9371b20a9

[Comment 5 Tim Sammut (RETIRED) 2012-01-08 19:07:45 UTC]

Thanks, everyone. Closing noglsa since stable packages were not affected.