Race Condition in XMPP Library Affects Smack by Ignite Realtime
CVE-2016-10027

5.9MEDIUM

Key Information:

Vendor

Igniterealtime

Status
Smack
Vendor
CVE Published:
12 January 2017

What is CVE-2016-10027?

The XMPP library in Smack prior to version 4.1.9 is susceptible to a race condition that occurs when the SecurityMode.required TLS setting is in use. This vulnerability enables man-in-the-middle attackers to circumvent TLS protections, inadvertently leading to the use of unencrypted authentication by stripping the 'starttls' capability from server responses. This flaw can seriously compromise the security of communication within applications utilizing the Smack library.

References

https://github.com/igniterealtime/Smack/commit/059ee99ba0...
x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisoryx_refsource_FEDORA
http://www.securityfocus.com/bid/95129
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.