Atheme IRC Services 'mycertfp_delete()' Function Security Bypass Vulnerability

Bugtraq ID:	52675
Class:	Design Error
CVE:	CVE-2012-1576
Remote:	Yes
Local:	No
Published:	Mar 20 2012 12:00AM
Updated:	Sep 25 2012 12:10PM
Credit:	Aaron M D Jones
Vulnerable:	Gentoo Linux Atheme IRC Services 6.0.9 Atheme IRC Services 5.2.7
Not Vulnerable:	Atheme IRC Services 7.0.0-devel Atheme IRC Services 6.0.10

Atheme IRC Services 'mycertfp_delete()' Function Security Bypass Vulnerability

Atheme IRC Services is prone to a security-bypass vulnerability.

Successfully exploiting this issue will allow attackers to bypass security restrictions and perform unauthorized actions.

Atheme IRC Services 'mycertfp_delete()' Function Security Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Atheme IRC Services 'mycertfp_delete()' Function Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Atheme IRC Services 'mycertfp_delete()' Function Security Bypass Vulnerability

References:

• Atheme IRC Services NickServ CERT fingerprint memory/tracking problem, security (Aaron M D Jones)
  
• atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries (William Pitcock)
  
• IRC Services Homepage (Atheme)