Skip to content

Commit

Permalink
couple of touchups to the ZNC PSA
Browse files Browse the repository at this point in the history
  • Loading branch information
jesopo committed Jul 3, 2024
1 parent 72312fd commit fedff27
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions content/_posts/2024-07-03-zncpsa.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,14 @@ TL;DR - If you are using a version of modtcl that is NOT from
In coordination with other IRC networks and ZNC providers, we're sending out a
global notice today about a vulnerability in a non-default core ZNC module,
modtcl. Please unload this module until it can be upgraded to a patched
version.
version. You can unload this module by running `/quote ZNC unloadmod modtcl`.

Modtcl in ZNC versions prior to 1.9.1 contains an injection vulnerability
([CVE-2024-39844]) that allows channel operators to run arbitrary ZNC
commands as a ZNC user in their channel. This exploit can be used to
compromise NickServ accounts or channels. Attacks may also leverage other
modules or vulnerabilities to compromise of the system user account running
ZNC.
modules or vulnerabilities to cause compromise of the system user account
that is running ZNC.

Luckily, modtcl is not loaded by default. To check if you have modtcl loaded,
run `/quote ZNC listmods` to see the list of loaded modules. If you have
Expand All @@ -31,7 +31,7 @@ have undertaken their own mitigations as they see fit. Please ask them
directly if you have questions.

We appreciate your help in ensuring that everyone gets updated as soon as
possible! We encourage you to contact ZNC using friends who are idle. Please
possible! We encourage you to contact ZNC-using friends who are idle. Please
also keep us informed in `#libera-hotline` about folks trying to take advantage
of this vulnerability.

Expand Down

0 comments on commit fedff27

Please sign in to comment.