CypherX/xAuth — Issue #19: xauth incorrectly grants hackers access to op command
Author: mmarcus
Created: 2011-12-08 18:45:49+00:00
State: open

Assume we have a system where the user named "Admin" has access to the op command, and where the user "Hacker" should not have access to the op command

1) Connect client #1 to server with username Admin. xauth correctly prevents any actions in this client since password has not been supplied
2) Connect client #2 to server, also with username Admin. xauth correctly blocks connection with message disconnected/you are already online.
3) Go back to client #1. issue op command, e.g. /op hacker. Fool Hacker appears in the servers ops.txt file. That is, the hacker has now been granted op privileges.