PT-2014-4896 · Ignite Realtime · Openfire

Publicado 2014-04-11 · Atualizado 2022-05-17 · CVE-2014-2741

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Openfire versions prior to 3.9.2

Description The issue allows remote attackers to cause a denial of service due to excessive resource consumption via a crafted XMPP stream, also known as an "xmppbomb" attack. This occurs because the processing of compressed XML elements is not properly restricted.

Recommendations For versions prior to 3.9.2, update to version 3.9.2 or later to resolve the issue.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-264

Identificadores relacionados

CVE-2014-2741

GHSA-J5QH-CP3P-2H87

Produtos afetados

Openfire

Referências · 12

• https://github.com/igniterealtime/Openfire · Nota
• https://github.com/igniterealtime/Openfire/commit/3aec383e07ee893b77396fe946766bbd3758af77 · Nota
• https://web.archive.org/web/20140407092132/http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas · Nota
• http://kb.cert.org/vuls/id/495476 · Nota
• http://community.igniterealtime.org/thread/52317 · Nota
• https://osv.dev/vulnerability/GHSA-j5qh-cp3p-2h87 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/04/09/1 · Nota
• http://fisheye.igniterealtime.org/changelog/openfiregit?cs=3aec383e07ee893b77396fe946766bbd3758af77 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2741 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/04/07/7 · Nota
• https://web.archive.org/web/20140705161237/http://fisheye.igniterealtime.org/changelog/openfiregit?cs=3aec383e07ee893b77396fe946766bbd3758af77 · Nota
• http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas · Nota