CVE-2016-7143
high
CVSS v3
8.1
CVSS v4 NEW
—
VIR risk
8.1
Description
The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Predictions
Exploit likelihood
88%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | 8.0 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| charybdis_project | charybdis | {"endIncluding":"3.5.2"} | |
References
- http://www.debian.org/security/2016/dsa-3661
- http://www.openwall.com/lists/oss-security/2016/09/04/3
- http://www.openwall.com/lists/oss-security/2016/09/05/8
- http://www.securityfocus.com/bid/92761
- https://github.com/charybdis-ircd/charybdis/blob/charybdis-3.5.3/NEWS.md
- https://github.com/charybdis-ircd/charybdis/commit/818a3fda944b26d4814132cee14cfda4ea4aa824
- http://www.debian.org/security/2016/dsa-3661
- http://www.openwall.com/lists/oss-security/2016/09/04/3
- http://www.openwall.com/lists/oss-security/2016/09/05/8
- http://www.securityfocus.com/bid/92761
- https://github.com/charybdis-ircd/charybdis/blob/charybdis-3.5.3/NEWS.md
- https://github.com/charybdis-ircd/charybdis/commit/818a3fda944b26d4814132cee14cfda4ea4aa824
CWEs
CWE-285
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.