CVE-2012-1576

Name of the Vulnerable Software and Affected Versions Atheme versions 5.x through 5.2.6 Atheme versions 6.x through 6.0.9 Atheme versions 7.x through 7.0.0-beta1

Description The issue arises from the myuser delete function in libathemecore/account.c, which fails to properly clean up CertFP entries when a user is deleted. This allows remote attackers to access a different user account or cause a denial of service, resulting in a daemon crash, by logging in as a deleted user.

Recommendations For Atheme versions 5.x through 5.2.6, update to version 5.2.7 or later. For Atheme versions 6.x through 6.0.9, update to version 6.0.10 or later. For Atheme versions 7.x through 7.0.0-beta1, update to version 7.0.0-beta2 or later.