Vulnerability: The CBounceDCCMod::OnPrivCTCP function in bouncedcc.cpp in the bouncedcc module in ZNC 0.200 and 0.202 allows remote attackers to cause a denial of service (crash) via a crafted DCC RESUME request.
Vulnerability ID: CVE-2012-0033
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/znc/znc
Published: 2014-04-08
File: modules/bouncedcc.cpp
Commit message: Fix crash in bouncedcc module.

It happens when DCC RESUME is received.
Affected ZNC versions: 0.200, 0.202.

Thanks to howeyc for reporting this and providing the patch.
Commit author: Alexey Sokolov

Vulnerable version (before fix):
 class CBounceDCCMod : public CModule { 					CDCCBounce* pSock = (CDCCBounce*) *it;  					if (pSock->GetLocalPort() == uResumePort) { 						m_pUser->PutUser(":" + Nick.GetNickMask() + " PRIVMSG " + m_pClient->GetNick() + " :\001DCC " + sType + " " + sFile + " " + CString(pSock->GetUserPort()) + " " + sMessage.Token(4) + "\001"); 					} 				} 			} else if (sType.Equals("ACCEPT")) { class CBounceDCCMod : public CModule { 					CDCCBounce* pSock = (CDCCBounce*) *it;  					if (pSock->GetUserPort() == sMessage.Token(3).ToUShort()) { 						m_pUser->PutUser(":" + Nick.GetNickMask() + " PRIVMSG " + m_pClient->GetNick() + " :\001DCC " + sType + " " + sFile + " " + CString(pSock->GetLocalPort()) + " " + sMessage.Token(4) + "\001"); 					} 				} 			}

Fixed version (after fix):
 class CBounceDCCMod : public CModule { 					CDCCBounce* pSock = (CDCCBounce*) *it;  					if (pSock->GetLocalPort() == uResumePort) { 						m_pUser->PutUser(":" + Nick.GetNickMask() + " PRIVMSG " + m_pUser->GetNick() + " :\001DCC " + sType + " " + sFile + " " + CString(pSock->GetUserPort()) + " " + sMessage.Token(4) + "\001"); 					} 				} 			} else if (sType.Equals("ACCEPT")) { class CBounceDCCMod : public CModule { 					CDCCBounce* pSock = (CDCCBounce*) *it;  					if (pSock->GetUserPort() == sMessage.Token(3).ToUShort()) { 						m_pUser->PutUser(":" + Nick.GetNickMask() + " PRIVMSG " + m_pUser->GetNick() + " :\001DCC " + sType + " " + sFile + " " + CString(pSock->GetLocalPort()) + " " + sMessage.Token(4) + "\001"); 					} 				} 			}

Patch:
patch: @@ -238,7 +238,7 @@ class CBounceDCCMod : public CModule {
 					CDCCBounce* pSock = (CDCCBounce*) *it;
 
 					if (pSock->GetLocalPort() == uResumePort) {
-						m_pUser->PutUser(":" + Nick.GetNickMask() + " PRIVMSG " + m_pClient->GetNick() + " :\001DCC " + sType + " " + sFile + " " + CString(pSock->GetUserPort()) + " " + sMessage.Token(4) + "\001");
+						m_pUser->PutUser(":" + Nick.GetNickMask() + " PRIVMSG " + m_pUser->GetNick() + " :\001DCC " + sType + " " + sFile + " " + CString(pSock->GetUserPort()) + " " + sMessage.Token(4) + "\001");
 					}
 				}
 			} else if (sType.Equals("ACCEPT")) {
@@ -248,7 +248,7 @@ class CBounceDCCMod : public CModule {
 					CDCCBounce* pSock = (CDCCBounce*) *it;
 
 					if (pSock->GetUserPort() == sMessage.Token(3).ToUShort()) {
-						m_pUser->PutUser(":" + Nick.GetNickMask() + " PRIVMSG " + m_pClient->GetNick() + " :\001DCC " + sType + " " + sFile + " " + CString(pSock->GetLocalPort()) + " " + sMessage.Token(4) + "\001");
+						m_pUser->PutUser(":" + Nick.GetNickMask() + " PRIVMSG " + m_pUser->GetNick() + " :\001DCC " + sType + " " + sFile + " " + CString(pSock->GetLocalPort()) + " " + sMessage.Token(4) + "\001");
 					}
 				}
 			}
path: modules/bouncedcc.cpp