PT-2017-16596 · Sleekxmpp+3 · Sleekxmpp+3

Publicado 2017-02-09 · Atualizado 2022-05-13 · CVE-2017-5591

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SleekXMPP versions 1.3.1 and earlier Slixmpp versions 1.2.3 and earlier poezio versions 0.8 through 0.10

Description The issue is related to an incorrect implementation of XEP-0280: Message Carbons in multiple XMPP clients. This allows a remote attacker to impersonate any user in the vulnerable application's display, enabling various kinds of social engineering attacks.

Recommendations For SleekXMPP versions 1.3.1 and earlier, update to a version later than 1.3.1. For Slixmpp versions 1.2.3 and earlier, update to a version later than 1.2.3. For poezio versions 0.8 through 0.10, update to a version later than 0.10.

Exploit

Correção

RCE

Origin Validation Error

Enumeração de Fraquezas

CWE-20

CWE-940

CWE-346

Identificadores relacionados

ALT-PU-2017-1284

CVE-2017-5591

GHSA-C35G-JR5F-H83P

PYSEC-2017-103

PYSEC-2017-104

Produtos afetados

Alt Linux

Sleekxmpp

Slixmpp

Poezio

Referências · 26

• 🔥 https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf · Exploit
• 🔥 https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons · Exploit
• 🔥 http://openwall.com/lists/oss-security/2017/02/09/29 · Exploit
• https://github.com/fritzy/SleekXMPP/commit/285495d5ee2427d93d961ceedcd1829383e5196d · Nota
• https://github.com/fritzy/SleekXMPP/issues/442 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/sleekxmpp/PYSEC-2017-103.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/slixmpp/PYSEC-2017-104.yaml · Nota
• https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8 · Correção
• https://github.com/poezio/slixmpp · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5591 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-104 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5591 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-c35g-jr5f-h83p · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-5591 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-5591 · Aviso do Fabricante