PT-2009-4083 · Ignite Realtime · Openfire

Devakrherz · Published 2009-05-11 · Updated 2022-05-02 · CVE-2009-1595

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Openfire versions prior to 3.6.4

Description: The issue allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd change action. This is due to a flaw in the jabber:iq:auth implementation in IQAuthHandler.java.

Recommendations: For versions prior to 3.6.4, update to version 3.6.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the passwd change action to prevent unauthorized password changes.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-1595

GHSA-R62W-X9PP-JRQP

Affected Products

Openfire

References · 16

• 🔥 http://igniterealtime.org/issues/browse/JM-1531 · Exploit
• 🔥 http://igniterealtime.org/community/message/190280 · Exploit
• 🔥 https://exploit-db.com/exploits/32967 · Exploit
• 🔥 http://securityfocus.com/bid/34804 · Exploit
• https://osv.dev/vulnerability/GHSA-r62w-x9pp-jrqp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1595 · Security Note
• http://vupen.com/english/advisories/2009/1237 · Vendor Advisory
• http://igniterealtime.org/builds/openfire/docs/latest/changelog.html · Patch
• http://secunia.com/advisories/34976 · Vendor Advisory
• https://github.com/igniterealtime/Openfire · Note
• https://github.com/igniterealtime/Openfire/commit/97e1f08cf72e430f5cca5ba94cd20703dadb5ce5 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50292 · Note
• https://web.archive.org/web/20090518061336/http://igniterealtime.org/issues/browse/JM-1531 · Note
• https://web.archive.org/web/20140901211944/http://securityfocus.com/bid/34804 · Note
• https://download.igniterealtime.org/openfire/docs/latest/changelog.html#3.6.4 · Note