UBUNTU-CVE-2017-10807: Critical severity ubuntu/jabberd2 vulnerability

Published Jul 4, 2017

Updated

JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.

Affected Software

1 affected component

ubuntu/jabberd2*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JabberD (jabberd2) to a version that resolves this vulnerability.
Fixed in 2.6.1

Event History

Jul 4, 2017

CVE Published

via OSV·03:29 PM

Data Sourced

via OSV·03:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does disabling the sasl.anonymous option protect an affected deployment?

No. Affected JabberD 2.x versions permit SASL ANONYMOUS authentication even when the sasl.anonymous c2s.xml option is not enabled.

What does an attacker need to exploit this issue?

The attacker needs network access to the JabberD service. No existing privileges or user interaction are required.

How can I determine whether my deployment is affected?

Deployments running JabberD 2.x before version 2.6.1 are affected. Upgrading to 2.6.1 or later addresses the issue.

UBUNTU-CVE-2017-10807: Critical severity ubuntu/jabberd2 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does disabling the sasl.anonymous option protect an affected deployment?

What does an attacker need to exploit this issue?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Does disabling the sasl.anonymous option protect an affected deployment?

What does an attacker need to exploit this issue?

How can I determine whether my deployment is affected?