CVE-2014-0363: Medium severity igniterealtime Smack vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-0363 to the following vulnerability:
Name: CVE-2014-0363 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0363 Assigned: 20131205 Reference: http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released Reference: http://issues.igniterealtime.org/browse/SMACK-410 Reference: CERT-VN:VU#489228 Reference: http://www.kb.cert.org/vuls/id/489228
The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.
The man-in-the-middle attacker requires a certificate that is valid for any domain name.
Upstream patch: http://fisheye.igniterealtime.org/changelog/smackgit?cs=93030c218c62cf0a0a8ea48746db1452fa34033c
From code inspection, this issue affects the 3.2.2 version in Fedora (the CERT advisory mentions version 3.4.1 and possibly earlier versions).
Other sources
It was found that the ServerTrustManager in the Smack XMPP API did not verify basicConstraints and nameConstraints in X.509 certificate chains. A man-in-the-middle attacker could use this flaw to spoof servers and obtain sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ignite Realtime Smack XMPP API (ServerTrustManager)to a version that resolves this vulnerability.Fixed in 4.0.0-rc1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-0363?
CVE-2014-0363 has a medium severity level, affecting the security of client-server communications.
What impact does CVE-2014-0363 have on affected systems?
CVE-2014-0363 can lead to potential disclosure of sensitive information from the Smack library.
How do I fix CVE-2014-0363?
To fix CVE-2014-0363, upgrade to a version of the Smack library later than 4.0.0.
Which software is affected by CVE-2014-0363?
CVE-2014-0363 affects the Ignite Realtime Smack library versions prior to 4.0.0.
Is there a patch available for CVE-2014-0363?
Yes, a patch has been implemented in versions of Smack released after 4.0.0.