Remote Spoofing Vulnerability in Ignite Realtime Smack XMPP API
CVE-2014-0364

Currently unrated

Key Information:

Vendor

Igniterealtime

Status
Smack
Vendor
CVE Published:
30 April 2014

What is CVE-2014-0364?

The ParseRoster component in the Ignite Realtime Smack XMPP API prior to version 4.0.0-rc1 is susceptible to a remote spoofing vulnerability. This occurs due to the component's failure to validate the 'from' attribute in a roster-query IQ stanza. Consequently, attackers can exploit this oversight to send forged IQ responses, potentially compromising the integrity of user communications.

References

http://secunia.com/advisories/59291
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/59290
third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2015-1176.html
vendor-advisoryx_refsource_REDHAT

EPSS Score

6% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.