Null pointer dereference in webadmin module [CVE-2013-2130]

[Thomas Ward]

This is CVE-2013-2130.

This is/was Debian bug 720632 (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=720632)

The security risk is that there is a null pointer dereference in the webadmin module.

This is fixed in Debian and ZNC 1.2 upstream.

Precise and Quantal are not affected as the CVE only affects ZNC 1.0 and newer, which means that it only applies to Raring, Saucy, and Trusty. See the notes below regarding Saucy and Trusty.

Raring is currently affected.

Saucy is "Fix Released" as the fix is already included as a patch in 1.0-5 from Debian, which is in Saucy. (02-CVE-2013-2130.diff in debian/patches for that package)

Trusty is "Fix Released" as the fix is incorporated into Debian 1.2-3 which is in Trusty right now.

[Jamie Strandboge (jdstrand)]

12.10 and earlier are not affected.

[Thomas Ward (teward)]

The attached debdiff here is a debdiff to fix this issue in Raring. This patch is derived from upstream diffs, and was extracted from 1.0-5 in Debian via their snapshots system. The patch has been edited from Debian to remove comments that were inserted and replace them with DEP3 headers.

This debdiff also contains a debian/changelog entry in accordance with the procedures to package security updates.

[Thomas Ward (teward)]

With the debdiff applied, the package successfully builds via sbuild in a raring chroot.

[Marc Deslauriers (mdeslaur)]

ACK on the debdiff. Package is building and will be released today. Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package znc - 1.0-2ubuntu1.1

---------------
znc (1.0-2ubuntu1.1) raring-security; urgency=low

  * SECURITY UPDATE: null pointer dereference in webadmin (LP: #1268658)
    - debian/patches/CVE-2013-2130.diff: Patch from Debian based on upstream to
      fix null pointer dereferences.
    - CVE-2013-2130
 -- Thomas Ward <email address hidden> Mon, 13 Jan 2014 12:20:57 -0500