CVE-2012-1576 The myuser_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0.10, and 7.x before 7.0.0-beta2 does not properly clean up CertFP entries when a user is deleted, which....
MediumCVSS 6.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The myuser_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0.10, and 7.x before 7.0.0-beta2 does not properly clean up CertFP entries when a user is deleted, which allows remote attackers to access a different user account or cause a denial of service (daemon crash) via a login as a deleted user.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atheme | = 6.0.0 | No fix listed |
| atheme | = 6.0.1 | No fix listed |
| atheme | = 6.0.2 | No fix listed |
| atheme | = 6.0.3 | No fix listed |
| atheme | = 6.0.4 | No fix listed |
| atheme | = 6.0.5 | No fix listed |
| atheme | = 6.0.6 | No fix listed |
| atheme | = 6.0.7 | No fix listed |
| atheme | = 6.0.8 | No fix listed |
| atheme | = 6.0.9 | No fix listed |
| atheme | = 7.0.0 | No fix listed |
| atheme | = 7.0.0-alpha1 | No fix listed |
| atheme | = 7.0.0-beta1 | No fix listed |
| atheme | = 7.0.0-beta2 | No fix listed |
| atheme | = 5.2.0 | No fix listed |
| atheme | = 5.2.1 | No fix listed |
| atheme | = 5.2.2 | No fix listed |
| atheme | = 5.2.3 | No fix listed |
| atheme | = 5.2.4 | No fix listed |
| atheme | = 5.2.5 | No fix listed |
| atheme | = 5.2.6 | No fix listed |
| atheme | = 5.2.7 | No fix listed |
References
- 20120321 atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour mailing-list
- git.atheme.org
- jira.atheme.org
- 48481 third-party-advisory vendor-advisory
- 50704 third-party-advisory
- GLSA-201209-09 vendor-advisory
- [oss-security] 20120321 atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour mailing-list
- [oss-security] 20120322 Re: atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour mailing-list
- 52675 vdb-entry