CVE-2016-7143
published 2016-09-21CVE-2016-7143: The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as…
PriorityP337high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
EPSS
1.06%
61.3th percentile
The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| charybdis_project | charybdis | <= 3.5.2 | — |
| charybdis_project | charybdis | >= 0 < 3.4.2-3ubuntu0.1~esm1 | 3.4.2-3ubuntu0.1~esm1 |
| debian | debian_linux | — | — |
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fr2x-9vgp-crvv: The m_authenticate function in modules/m_sasl
ghsa_unreviewed·2022-05-17
CVE-2016-7143 [HIGH] CWE-285 GHSA-fr2x-9vgp-crvv: The m_authenticate function in modules/m_sasl
The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
OSV
CVE-2016-7143: The m_authenticate function in modules/m_sasl
osv·2016-09-21·CVSS 8.1
CVE-2016-7143 [HIGH] CVE-2016-7143: The m_authenticate function in modules/m_sasl
The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.debian.org/security/2016/dsa-3661http://www.openwall.com/lists/oss-security/2016/09/04/3http://www.openwall.com/lists/oss-security/2016/09/05/8http://www.securityfocus.com/bid/92761https://github.com/charybdis-ircd/charybdis/blob/charybdis-3.5.3/NEWS.mdhttps://github.com/charybdis-ircd/charybdis/commit/818a3fda944b26d4814132cee14cfda4ea4aa824http://www.debian.org/security/2016/dsa-3661http://www.openwall.com/lists/oss-security/2016/09/04/3http://www.openwall.com/lists/oss-security/2016/09/05/8http://www.securityfocus.com/bid/92761https://github.com/charybdis-ircd/charybdis/blob/charybdis-3.5.3/NEWS.mdhttps://github.com/charybdis-ircd/charybdis/commit/818a3fda944b26d4814132cee14cfda4ea4aa824
2016-09-21
Published