jabberd SASL denial of service
| jabberd-sasl-dos (25334) |  Low Risk |
Description:
jabberd is vulnerable to a denial of service caused by improper handling of SASL negotiations. A remote attacker could exploit this vulnerability by sending a "response" stanza before an "auth" stanza to cause the service to crash.
Platforms Affected:
- jabberd project, jabberd prior to 2.0s9
- RedHat, Network Proxy 4.2
- RedHat, Network Proxy 5.0
- RedHat, Network Satellite Server 4.2
- RedHat, Network Satellite Server 5.0
Remedy:
Upgrade to the latest version of jabberd (2.0s11 or later), available from the jabberd project Download Web page. See References.
Consequences:
Denial of Service
References:
- jabberd project Download Web page, jabberd project at http://jabberd.jabberstudio.org/2/.
- BID-17155: Jabber Studio JabberD Remote Denial Of Service Vulnerability
- CVE-2006-1329: The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (c2s segfault) by sending a response stanza before an auth stanza.
- FrSIRT/ADV-2006-1009: Jabberd SASL Negotiation response Stanza Denial of Service Vulnerability
- RHSA-2008-0261: Moderate: Red Hat Network Satellite Server security update
- RHSA-2008-0263: Low: Red Hat Network Proxy Server security update
- RHSA-2008-0523: Low: Red Hat Network Proxy Server security update
- RHSA-2008-0524: Low: Red Hat Network Satellite Server security update
- SA19281: jabberd SASL Negotiation Denial of Service Vulnerability
Reported:
Mar 20, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net