CVE-2016-7143 Auth bypass in n/a
Remote attackers can spoof certificate fingerprints to log in as another user in Charybdis IRC servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7143?
CVE-2016-7143 is a high-severity authentication bypass vulnerability in Debian Debian Linux, published on 21 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Weakness: CWE-285
Which versions are affected by CVE-2016-7143?
It affects 2 products.
Linux distribution packages (2)
charybdis openSUSE:Tumbleweed | All versions | 3.5.3-2.1 |
solanum openSUSE:Tumbleweed | All versions | 0~ch448-1.4 |
Products include Charybdis Project Charybdis, Debian Debian Linux.
How do I fix CVE-2016-7143?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-7143 being exploited?
There is no known exploitation of CVE-2016-7143 in the wild and no public exploit code.
Sources
Also known as DSA-3661-1, GHSA-fr2x-9vgp-crvv, UBUNTU-CVE-2016-7143, openSUSE-SU-2024:10220-1, openSUSE-SU-2024:11392-1.