CVE - CVE-2012-1576

CVE-ID
CVE-2012-1576	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The myuser_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0.10, and 7.x before 7.0.0-beta2 does not properly clean up CertFP entries when a user is deleted, which allows remote attackers to access a different user account or cause a denial of service (daemon crash) via a login as a deleted user.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:52675 URL:http://www.securityfocus.com/bid/52675 CONFIRM:http://git.atheme.org/atheme/commit/?id=3d9551761db2 CONFIRM:http://jira.atheme.org/browse/SRV-166 FULLDISC:20120321 atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour URL:http://archives.neohapsis.com/archives/fulldisclosure/2012-03/0248.html GENTOO:GLSA-201209-09 URL:http://security.gentoo.org/glsa/glsa-201209-09.xml MLIST:[oss-security] 20120321 atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour URL:http://www.openwall.com/lists/oss-security/2012/03/22/3 MLIST:[oss-security] 20120322 Re: atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour URL:http://www.openwall.com/lists/oss-security/2012/03/23/2 SECUNIA:48481 URL:http://secunia.com/advisories/48481 SECUNIA:50704 URL:http://secunia.com/advisories/50704
Assigning CNA
Red Hat, Inc.
Date Record Created
20120312	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20120312)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)