CVE-2016-7143: High severity Debian Debian Linux vulnerability
The mauthenticate function in modules/msasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/charybdisto a version that resolves this vulnerability.Fixed in 3.4.2-3ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/charybdisto a version that resolves this vulnerability.Fixed in 3.5.0-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
Which deployments are affected?
Charybdis versions before 3.5.3 are affected. The listed software includes Debian Linux and Charybdis Project Charybdis.
What does an attacker need to exploit this issue?
An attacker can exploit the flaw remotely without privileges or user interaction by sending a crafted AUTHENTICATE parameter. Successful exploitation can spoof certificate fingerprints and allow login as another user.
Is a patch available?
Yes. Updating Charybdis to version 3.5.3 or later addresses the affected version range.