PT-2008-3269 · Ignite Realtime · Openfire

Robert Buchholz · Published 2008-04-11 · Updated 2022-05-01 · CVE-2008-1728

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Openfire version 3.4.5

Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon outage. This is achieved by triggering large outgoing queues without reading messages, specifically in the ConnectionManagerImpl.java component.

Recommendations For Openfire version 3.4.5, consider restricting access to the ConnectionManagerImpl.java component to minimize the risk of exploitation until a patch is available. As a temporary workaround, monitor and limit the size of outgoing queues to prevent daemon outages.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-1728

GHSA-X337-43MR-GG3H

Affected Products

Openfire

References · 17

• http://igniterealtime.org/issues/browse/JM-1289 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-26.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1728 · Security Note
• https://osv.dev/vulnerability/GHSA-x337-43mr-gg3h · Vendor Advisory
• http://secunia.com/advisories/29751 · Vendor Advisory
• http://secunia.com/advisories/29901 · Vendor Advisory
• https://github.com/igniterealtime/Openfire · Note
• https://github.com/igniterealtime/Openfire/commit/c9cd1e521673ef0cccb8795b78d3cbaefb8a576a · Note
• https://web.archive.org/web/20080724051528/http://secunia.com/advisories/29901 · Note
• http://igniterealtime.org/fisheye/changelog/svn-org?cs=10031 · Note
• http://securityfocus.com/bid/28722 · Note
• https://web.archive.org/web/20080517012408/http://securityfocus.com/bid/28722 · Note
• http://igniterealtime.org/builds/openfire/docs/latest/changelog.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41744 · Note
• http://openwall.com/lists/oss-security/2008/04/10/7 · Note