First published: Fri Feb 18 2011(Updated: )
jingle-factory.c in Telepathy Gabble 0.11 before 0.11.7, 0.10 before 0.10.5, and 0.8 before 0.8.15 allows remote attackers to sniff audio and video calls via a crafted google:jingleinfo stanza that specifies an alternate server for streamed media.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
Red Hat Telepathy Gabble | =0.11.4 | |
Red Hat Telepathy Gabble | =0.11.5 | |
Red Hat Telepathy Gabble | =0.11.2 | |
Red Hat Telepathy Gabble | =0.11.3 | |
Red Hat Telepathy Gabble | =0.11.6 | |
Red Hat Telepathy Gabble | =0.11 | |
Red Hat Telepathy Gabble | =0.11.1 | |
Red Hat Telepathy Gabble | =0.10.1 | |
Red Hat Telepathy Gabble | =0.10.3 | |
Red Hat Telepathy Gabble | =0.10 | |
Red Hat Telepathy Gabble | =0.10.2 | |
Red Hat Telepathy Gabble | =0.10.4 | |
Red Hat Telepathy Gabble | =0.8.14 | |
Red Hat Telepathy Gabble | =0.8.11 | |
Red Hat Telepathy Gabble | =0.8.10 | |
Red Hat Telepathy Gabble | =0.8.12 | |
Red Hat Telepathy Gabble | =0.8.5 | |
Red Hat Telepathy Gabble | =0.8.6 | |
Red Hat Telepathy Gabble | =0.8.3 | |
Red Hat Telepathy Gabble | =0.8.4 | |
Red Hat Telepathy Gabble | =0.8.9 | |
Red Hat Telepathy Gabble | =0.8.2 | |
Red Hat Telepathy Gabble | =0.8.1 | |
Red Hat Telepathy Gabble | =0.8.8 | |
Red Hat Telepathy Gabble | =0.8 | |
Red Hat Telepathy Gabble | =0.8.7 | |
Red Hat Telepathy Gabble | =0.8.13 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2011-1000 has a medium severity level as it allows remote attackers to potentially sniff audio and video calls.
To mitigate CVE-2011-1000, update Telepathy Gabble to version 0.11.7 or later, 0.10.5 or later, or 0.8.15 or later.
CVE-2011-1000 affects Telepathy Gabble versions 0.11.4 to 0.11.6, 0.10 before 0.10.5, and 0.8 before 0.8.15.
CVE-2011-1000 is a remote code execution vulnerability that can be exploited via crafted google:jingleinfo stanzas.
Yes, CVE-2011-1000 can be exploited remotely without requiring user interaction.