https://bugzilla.redhat.com/show_bug.cgi?id=1093276
Bug ID: 1093276
Summary: CVE-2014-0364 smack: IQ response spoofing
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mmcallis(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it, weli(a)redhat.com
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-0364 to
the following vulnerability:
Name: CVE-2014-0364
URL:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0364
Assigned: 20131205
Reference:
http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc...
Reference: CERT-VN:VU#489228
Reference:
http://www.kb.cert.org/vuls/id/489228
The ParseRoster component in the Ignite Realtime Smack XMPP API before
4.0.0-rc1 does not verify the from attribute of a roster-query IQ
stanza, which allows remote attackers to spoof IQ responses via a
crafted attribute.
It is not clear whether this flaw affects the version of smack in Fedora. Both
of these look to be needed to complete the fix:
http://issues.igniterealtime.org/browse/SMACK-533
http://issues.igniterealtime.org/browse/SMACK-538
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=qnIcfuydl7&a=cc_unsubscribe