https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Bug ID: 1127276 Summary: CVE-2014-5075 smack: MitM vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: brms-jira@redhat.com, java-sig-commits@lists.fedoraproject.org, pavelp@redhat.com, puntogil@libero.it, tkirby@redhat.com, weli@redhat.com
It was reported [1] that Smack (XMPP client library) is vulnerable to MitM attacks with a crafted SSL certificates. Quote from [1]: ... Details -------
Smack is using Java's `SSLSocket`, which checks the peer certificate using an `X509TrustManager`, but does not perform hostname verification. Therefore, it is possible to redirect the traffic between a Smack-using application and a legitimate XMPP server through the attacker's server, merely by providing a valid certificate for a domain under the attacker's control.
In Smack versions 2.2.0 to 3.4.1, a custom `ServerTrustManager` implementation was used, which was supplied with the connection's server name, and performed hostname verification. However, it failed to verify the basicConstraints and nameConstraints of the certificate chain (CVE-2014-0363, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0363) and has been removed in Smack 4.0.0.
Applications using Smack 2.2.0 to 3.4.1 with a custom `TrustManager` did not benefit from `ServerTrustManager` and are vulnerable as well, unless their own `TrustManager` implementation explicitly performs hostname verification. ...
[1]: http://seclists.org/bugtraq/2014/Aug/29
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1127277
--- Comment #1 from Vasyl Kaigorodov vkaigoro@redhat.com ---
Created smack tracking bugs for this issue:
Affects: fedora-all [bug 1127277]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1127277 [Bug 1127277] CVE-2014-5075 smack: MitM vulnerability [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1127281
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Arun Babu Neelicattu aneelica@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2014 |impact=moderate,public=2014 |0805,reported=20140806,sour |0805,reported=20140806,sour |ce=bugtraq,cvss2=5.8/AV:N/A |ce=bugtraq,cvss2=5.8/AV:N/A |C:M/Au:N/C:P/I:P/A:N,fedora |C:M/Au:N/C:P/I:P/A:N,fedora |-all/smack=affected,brms-5/ |-all/smack=affected,brms-5/ |smack=new,jboss/fuse-6=new, |smack=new,jboss/fuse-6=new, |jboss/fuse-esb=new |jboss/fuse-esb-7=new
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Arun Babu Neelicattu aneelica@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aneelica@redhat.com
--- Comment #2 from Arun Babu Neelicattu aneelica@redhat.com --- References:
http://seclists.org/bugtraq/2014/Aug/29
Upstream Issue:
https://igniterealtime.org/issues/browse/SMACK-586
Upstream Commits:
http://fisheye.igniterealtime.org/changelog/smackgit?cs=057d00c9de04d576db40...
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Arun Babu Neelicattu aneelica@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|4.0.2 |smack-core 4.0.2, smack-tcp | |4.0.2, smack 4.0.2
https://bugzilla.redhat.com/show_bug.cgi?id=1127276 Bug 1127276 depends on bug 1127277, which changed state.
Bug 1127277 Summary: CVE-2014-5075 smack: MitM vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1127277
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
--- Comment #3 from Fedora Update System updates@fedoraproject.org --- smack-3.2.2-5.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2014 |impact=moderate,public=2014 |0805,reported=20140806,sour |0805,reported=20140806,sour |ce=bugtraq,cvss2=5.8/AV:N/A |ce=bugtraq,cvss2=5.8/AV:N/A |C:M/Au:N/C:P/I:P/A:N,fedora |C:M/Au:N/C:P/I:P/A:N,fedora |-all/smack=affected,brms-5/ |-all/smack=affected,brms-5/ |smack=new,jboss/fuse-6=new, |smack=wontfix,jboss/fuse-6= |jboss/fuse-esb-7=new |new,jboss/fuse-esb-7=new
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |chazlett@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1232965
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
--- Doc Text *updated* by Chess Hazlett chazlett@redhat.com --- It was found that SSLSocket in Smack did not perform hostname verification. An attacker could redirect traffic between an application and an XMPP server by providing a valid certificate for a domain under the attacker's control.
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
--- Comment #5 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Via RHSA-2015:1176 https://rhn.redhat.com/errata/RHSA-2015-1176.html
https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2016-01-21 16:04:49
java-sig-commits@lists.fedoraproject.org