PT-2012-3351 · Atheme · Atheme

William Pitcock · Publicado 2012-10-01 · Atualizado 2013-04-05 · CVE-2012-1576

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Atheme versions 5.x through 5.2.6 Atheme versions 6.x through 6.0.9 Atheme versions 7.x through 7.0.0-beta1

Description The issue arises from the myuser delete function in libathemecore/account.c, which fails to properly clean up CertFP entries when a user is deleted. This allows remote attackers to access a different user account or cause a denial of service, resulting in a daemon crash, by logging in as a deleted user.

Recommendations For Atheme versions 5.x through 5.2.6, update to version 5.2.7 or later. For Atheme versions 6.x through 6.0.9, update to version 6.0.10 or later. For Atheme versions 7.x through 7.0.0-beta1, update to version 7.0.0-beta2 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-1576

Produtos afetados

Atheme

Referências · 10

• http://security.gentoo.org/glsa/glsa-201209-09.xml · Aviso do Fabricante
• http://secunia.com/advisories/50704 · Nota
• http://jira.atheme.org/browse/SRV-166 · Nota
• http://git.atheme.org/atheme/commit/?id=3d9551761db2 · Nota
• http://openwall.com/lists/oss-security/2012/03/22/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1576 · Nota de Segurança
• http://archives.neohapsis.com/archives/fulldisclosure/2012-03/0248.html · Nota
• http://securityfocus.com/bid/52675 · Nota
• http://secunia.com/advisories/48481 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/03/23/2 · Nota