CVE-2014-5075: Medium severity red hat jboss fuse vulnerability
It was reported [1] that Smack (XMPP client library) is vulnerable to MitM attacks with a crafted SSL certificates. Quote from [1]: ... Details -------
Smack is using Java's SSLSocket, which checks the peer certificate using an X509TrustManager, but does not perform hostname verification. Therefore, it is possible to redirect the traffic between a Smack-using application and a legitimate XMPP server through the attacker's server, merely by providing a valid certificate for a domain under the attacker's control.
In Smack versions 2.2.0 to 3.4.1, a custom ServerTrustManager implementation was used, which was supplied with the connection's server name, and performed hostname verification. However, it failed to verify the basicConstraints and nameConstraints of the certificate chain (CVE-2014-0363, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0363) and has been removed in Smack 4.0.0.
Applications using Smack 2.2.0 to 3.4.1 with a custom TrustManager did not benefit from ServerTrustManager and are vulnerable as well, unless their own TrustManager implementation explicitly performs hostname verification. ...
[1]: http://seclists.org/bugtraq/2014/Aug/29
Other sources
The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5075?
CVE-2014-5075 is considered a moderate severity vulnerability due to its potential for MitM attacks.
How do I fix CVE-2014-5075?
To fix CVE-2014-5075, update affected software to version 4.0.2 or later.
Which software is affected by CVE-2014-5075?
CVE-2014-5075 affects the Smack library versions earlier than 4.0.2 and certain versions of Red Hat JBoss Fuse.
What kind of attacks can CVE-2014-5075 lead to?
CVE-2014-5075 can lead to Man-in-the-Middle (MitM) attacks due to lack of hostname verification.
How does CVE-2014-5075 affect SSL connections?
CVE-2014-5075 allows for SSL connections to be compromised by accepting unverified SSL certificates.