PT-2009-4084 · Ignite Realtime · Openfire

Devakrherz · Published 2009-05-11 · Updated 2024-02-13 · CVE-2009-1596

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Openfire versions prior to 3.6.5

Description: The issue is related to the improper implementation of the register.password (also known as canChangePassword) console configuration setting. This allows remote authenticated users to bypass the intended policy and change their own passwords via a passwd change IQ packet.

Recommendations: For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the passwd change IQ packet to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-1596

Affected Products

Openfire

References · 7

• 🔥 http://securityfocus.com/bid/34804 · Exploit
• 🔥 http://igniterealtime.org/community/message/190280 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1596 · Security Note
• http://igniterealtime.org/issues/browse/JM-1532 · Vendor Advisory
• http://secunia.com/advisories/34984 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50291 · Note
• http://osvdb.org/54189 · Note