GLSA 201209-09: Atheme IRC Services: Denial of Service

http://security.gentoo.org/

Severity:	normal
Title:	Atheme IRC Services: Denial of Service
Date:	09/25/2012
Bugs:	#409103
ID:	201209-09

Synopsis

A vulnerability has been found in Atheme which may lead to Denial of Service or a bypass of security restrictions.

Background

Atheme is a portable and secure set of open-source and modular IRC services. CertFP is certificate fingerprinting used to authenticate users to nicknames.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
net-irc/atheme-services	< 6.0.10	>= 6.0.10	All supported architectures

Description

The “myuser_delete()” function in account.c does not properly remove CertFP entries when deleting user accounts.

Impact

A remote authenticated attacker may be able to cause a Denial of Service condition or gain access to an Atheme IRC Services user account.

Workaround

There is no known workaround at this time.

Resolution

All Atheme users should upgrade to the latest version:

      # emerge --sync
      # emerge --ask --oneshot --verbose ">=net-irc/atheme-services-6.0.10"

References

CVE-2012-1576

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201209-09.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.