CVE-2016-7145

CRITICAL

nefarious2 - Certificate Fingerprint Spoofing via AUTHENTICATE Parameter

Title source: llm

Description

The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.

References (2)

Core 2

Core References

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

https://github.com/evilnet/nefarious2/commit/f50a84bad996d438e7b31b9e74c32a41e43f8be5

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/09/05/9

Scores

CVSS v3 9.8

EPSS 0.0089

EPSS Percentile 54.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287

Status published

Products (1)

nefarious2_project/nefarious2 2.0

Published Mar 07, 2017

Tracked Since Feb 18, 2026