adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

znc 1.6.1 is susceptible to DoS due to "Secure Client-Initiated Renegotiation" #624

New Issue
Open
opened 2026-10-05 04:34:03 +02:00 by adam · 4 comments
adam commented 2026-10-05 04:34:03 +02:00
Owner
Copy link
Copy source

I ran testssl.sh against znc, and it reported znc was vulnerable to DoS due to "Secure Client-Initiated Renegotiation".

  • Environment
    • OS : ArchLinux
    • OpenSSL 1.0.2.d
    • znc 1.6.1

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

I ran [testssl.sh](https://testssl.sh/) against znc, and it reported znc was vulnerable to DoS due to "Secure Client-Initiated Renegotiation". - Environment - OS : ArchLinux - OpenSSL 1.0.2.d - znc 1.6.1 ## <bountysource-plugin> Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/27552123-znc-1-6-1-is-susceptible-to-dos-due-to-secure-client-initiated-renegotiation?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin> <!-- github-sync-id:112377257 -->
adam commented 2026-10-05 04:34:04 +02:00
Author
Owner
Copy link
Copy source

Can confirm on:

  • ZNC 1.7.x-git-473-cc76522 - http://znc.in
    • IPv6: yes, SSL: yes, DNS: threads, charset: yes
  • Debian GNU/Linux 7.9 (wheezy)
 Triple DES Ciphers           offered (NOT ok)
 Signature Algorithm          SHA1 with RSA
 Secure Client-Initiated Renegotiation     VULNERABLE (NOT ok), DoS threat

With the other issues, the first ZNC can probably do something to and the second I wonder with self-signed certificate.

Can confirm on: - ZNC 1.7.x-git-473-cc76522 - http://znc.in - IPv6: yes, SSL: yes, DNS: threads, charset: yes - Debian GNU/Linux 7.9 (wheezy) ``` Triple DES Ciphers offered (NOT ok) Signature Algorithm SHA1 with RSA Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), DoS threat ``` With the other issues, the first ZNC can probably do something to and the second I wonder with self-signed certificate. <!-- github-comment-id:149617525 -->
adam commented 2026-10-05 04:34:05 +02:00
Author
Owner
Copy link
Copy source

(About triple DES: Doesn't znc use the default cipher list from OpenSSL, unless something is explicitly set in znc.conf? If so, then the default should be changed in OpenSSL.)
Fix in node.js for the renegotiation DoS: https://github.com/nodejs/node-v0.x-archive/commit/3415427dbfbd590bbee3d777ffc73dde3c67790d

(About triple DES: Doesn't znc use the default cipher list from OpenSSL, unless something is explicitly set in znc.conf? If so, then the default should be changed in OpenSSL.) Fix in node.js for the renegotiation DoS: https://github.com/nodejs/node-v0.x-archive/commit/3415427dbfbd590bbee3d777ffc73dde3c67790d <!-- github-comment-id:149806759 -->
adam commented 2026-10-05 04:34:06 +02:00
Author
Owner
Copy link
Copy source

No, it has its own default cipher list:
https://github.com/znc/znc/blob/d66cb36cc3cef65f472f4c6535128b9f785c94b4/src/Socket.cpp#L32
which is used unless something is explicitly set in znc.conf

2015-10-21 8:44 GMT+01:00 Uli Schlachter notifications@github.com:

(About triple DES: Doesn't znc use the default cipher list from OpenSSL,
unless something is explicitly set in znc.conf? If so, then the default
should be changed in OpenSSL.)
Fix in node.js for the renegotiation DoS: nodejs/node-v0.x-archive@3415427
https://github.com/nodejs/node-v0.x-archive/commit/3415427dbfbd590bbee3d777ffc73dde3c67790d

—
Reply to this email directly or view it on GitHub
https://github.com/znc/znc/issues/1162#issuecomment-149806759.

No, it has its own default cipher list: https://github.com/znc/znc/blob/d66cb36cc3cef65f472f4c6535128b9f785c94b4/src/Socket.cpp#L32 which is used unless something is explicitly set in znc.conf 2015-10-21 8:44 GMT+01:00 Uli Schlachter notifications@github.com: > (About triple DES: Doesn't znc use the default cipher list from OpenSSL, > unless something is explicitly set in znc.conf? If so, then the default > should be changed in OpenSSL.) > Fix in node.js for the renegotiation DoS: nodejs/node-v0.x-archive@3415427 > https://github.com/nodejs/node-v0.x-archive/commit/3415427dbfbd590bbee3d777ffc73dde3c67790d > > — > Reply to this email directly or view it on GitHub > https://github.com/znc/znc/issues/1162#issuecomment-149806759. <!-- github-comment-id:149817379 -->
adam commented 2026-10-05 04:34:06 +02:00
Author
Owner
Copy link
Copy source

Btw, this was reported at IRC first at 2012-12-14 (kerio didn't open the github bug though, so it was forgotten)

[10:57:15] <kerio> easiest fix of your life: disable renegotiation
[10:57:29] <kerio> cuz it's a security issue anyway
[10:57:34] <DarthGandalf> is it?
[10:57:42] <kerio> allows for easy DDOS
...
[15:24:32] <kerio> DarthGandalf: https://community.qualys.com/blogs/securitylabs/2011/10/31/tls-renegotiation-and-denial-of-service-attacks

And today it was reported again, by tomreyn.

Btw, this was reported at IRC first at 2012-12-14 (kerio didn't open the github bug though, so it was forgotten) ``` [10:57:15] <kerio> easiest fix of your life: disable renegotiation [10:57:29] <kerio> cuz it's a security issue anyway [10:57:34] <DarthGandalf> is it? [10:57:42] <kerio> allows for easy DDOS ... [15:24:32] <kerio> DarthGandalf: https://community.qualys.com/blogs/securitylabs/2011/10/31/tls-renegotiation-and-denial-of-service-attacks ``` And today it was reported again, by tomreyn. <!-- github-comment-id:163465303 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#624