https://bugzilla.redhat.com/show_bug.cgi?id=1406703
Bug ID: 1406703
Summary: smack: TLS SecurityMode.required bypass via StripTLS
attack
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
chazlett(a)redhat.com, etirelli(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, kconner(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lpetrovi(a)redhat.com, mbaluch(a)redhat.com,
mwinkler(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, projects.rg(a)smart.ms,
puntogil(a)libero.it, rrajasek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com
A vulnerability in the Smack XMPP library was reported where the security of
the TLS connection is not always enforced. By stripping the "starttls"
feature from the server response with a man-in-the-middle tool, an attacker
can force the client to authenticate in clear text even if the
"SecurityMode.required" TLS setting has been set.
References:
http://seclists.org/oss-sec/2016/q4/716
https://community.igniterealtime.org/blogs/ignite/2016/11/22/smack-securi...
Upstream bug:
https://issues.igniterealtime.org/browse/SMACK-739
Upstream patches:
https://github.com/igniterealtime/Smack/commit/059ee99ba0d5ff7758829acf5a...
https://github.com/igniterealtime/Smack/commit/a9d5cd4a611f47123f9561bc5a...
--
You are receiving this mail because:
You are on the CC list for the bug.