CVE-2020-13775 (published 2020-06-02T23:15Z)

ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/znc/znc
commit_details: repo_url: https://github.com/znc/znc
author: Alexey Sokolov
author_date: 2020-05-31 11:32:04+01:00
msg: Fix null pointer dereference in echo-message

The bug was introduced while fixing #1705. If a client did not enable
echo-message, and doesn't have a network, it crashes.

Thanks to LunarBNC for reporting this
repository: repo_url: https://github.com/znc/znc
repo_name: znc/znc
description: Official repository for the ZNC IRC bouncer
repo_language: C++
owner: znc
file_changes: filename: Client.cpp
change_type: ModificationType.MODIFY
diff: @@ -889,7 +889,7 @@ void CClient::EchoMessage(const CMessage& Message) {
     CMessage EchoedMessage = Message;
     for (CClient* pClient : GetClients()) {
         if (pClient->HasEchoMessage() ||
-            (pClient != this && (m_pNetwork->IsChan(Message.GetParam(0)) ||
+            (pClient != this && ((m_pNetwork && m_pNetwork->IsChan(Message.GetParam(0))) ||
                                  pClient->HasSelfMessage()))) {
             EchoedMessage.SetNick(GetNickMask());
             pClient->PutClient(EchoedMessage);

programming_language: C++
filename: core.cpp
change_type: ModificationType.MODIFY
diff: @@ -297,6 +297,14 @@ TEST_F(ZNCTest, StatusEchoMessage) {
     client.Write("PRIVMSG *status :blah");
     client.ReadUntil(":nick!user@irc.znc.in PRIVMSG *status :blah");
     client.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
+    client.Write("znc delnetwork test");
+    client.ReadUntil("Network deleted");
+    auto client2 = LoginClient();
+    client2.Write("PRIVMSG *status :blah2");
+    client2.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
+    auto client3 = LoginClient();
+    client3.Write("PRIVMSG *status :blah3");
+    client3.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
 }
 
 }  // namespace

programming_language: C++
repo_url: https://github.com/znc/znc
commit_details: repo_url: https://github.com/znc/znc
author: Alexey Sokolov
author_date: 2020-03-29 08:45:10+01:00
msg: Fix echo-message for *status

Close #1705
repository: repo_url: https://github.com/znc/znc
repo_name: znc/znc
description: Official repository for the ZNC IRC bouncer
repo_language: C++
owner: znc
file_changes: filename: Client.cpp
change_type: ModificationType.MODIFY
diff: @@ -1234,6 +1234,8 @@ bool CClient::OnTextMessage(CTextMessage& Message) {
         }
 
         if (sTarget.TrimPrefix(m_pUser->GetStatusPrefix())) {
+            EchoMessage(Message);
+
             if (sTarget.Equals("status")) {
                 CString sMsg = Message.GetText();
                 UserCommand(sMsg);

programming_language: C++
filename: core.cpp
change_type: ModificationType.MODIFY
diff: @@ -14,9 +14,10 @@
  * limitations under the License.
  */
 
-#include "znctest.h"
 #include <gmock/gmock.h>
 
+#include "znctest.h"
+
 using testing::HasSubstr;
 
 namespace znc_inttest {
@@ -244,7 +245,8 @@ TEST_F(ZNCTest, AwayNotify) {
     client.Write("USER user/test x x :x");
     QByteArray cap_ls;
     client.ReadUntilAndGet(" LS :", cap_ls);
-    ASSERT_THAT(cap_ls.toStdString(), AllOf(HasSubstr("cap-notify"), Not(HasSubstr("away-notify"))));
+    ASSERT_THAT(cap_ls.toStdString(),
+                AllOf(HasSubstr("cap-notify"), Not(HasSubstr("away-notify"))));
     client.Write("CAP REQ :cap-notify");
     client.ReadUntil("ACK :cap-notify");
     client.Write("CAP END");
@@ -284,5 +286,15 @@ TEST_F(ZNCTest, JoinKey) {
     ircd.ReadUntil("JOIN #znc secret");
 }
 
+TEST_F(ZNCTest, StatusEchoMessage) {
+    auto znc = Run();
+    auto ircd = ConnectIRCd();
+    auto client = LoginClient();
+    client.Write("CAP REQ :echo-message");
+    client.Write("PRIVMSG *status :blah");
+    client.ReadUntil(":nick!user@irc.znc.in PRIVMSG *status :blah");
+    client.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
+}
+
 }  // namespace
 }  // namespace znc_inttest

programming_language: C++