CVE-2016-7142 The m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allows remote attackers to spoof certificate fingerprints and consequently log in as a...
MediumCVSS 5.9
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted SASL message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/inspircd(Debian:12) | < 2.0.23-1 | 2.0.23-1 |
| debian/inspircd(Debian:13) | < 2.0.23-1 | 2.0.23-1 |
| inspircd | <= 2.0.22 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-7142 vendor-advisory
- DSA-3662 third-party-advisory vendor-advisory
- www.inspircd.org release-notes vendor-advisory
- [oss-security] 20160904 CVE ID request: certificate spoofing through crafted SASL message in inspircd, charybdis mailing-list
- [oss-security] 20160905 Re: CVE ID request: certificate spoofing through crafted SASL message in inspircd, charybdis mailing-list third-party-advisory
- github.com
- bugs.debian.org issue-tracking