PT-2014-4896 · Ignite Realtime · Openfire

Published 2014-04-11 · Updated 2022-05-17 · CVE-2014-2741

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Openfire versions prior to 3.9.2

Description The issue allows remote attackers to cause a denial of service due to excessive resource consumption via a crafted XMPP stream, also known as an "xmppbomb" attack. This occurs because the processing of compressed XML elements is not properly restricted.

Recommendations For versions prior to 3.9.2, update to version 3.9.2 or later to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-264

Related Identifiers

CVE-2014-2741

GHSA-J5QH-CP3P-2H87

Affected Products

Openfire

References · 12

• https://osv.dev/vulnerability/GHSA-j5qh-cp3p-2h87 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2741 · Security Note
• https://github.com/igniterealtime/Openfire · Note
• https://github.com/igniterealtime/Openfire/commit/3aec383e07ee893b77396fe946766bbd3758af77 · Note
• https://web.archive.org/web/20140407092132/http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas · Note
• http://kb.cert.org/vuls/id/495476 · Note
• http://community.igniterealtime.org/thread/52317 · Note
• http://openwall.com/lists/oss-security/2014/04/09/1 · Note
• http://fisheye.igniterealtime.org/changelog/openfiregit?cs=3aec383e07ee893b77396fe946766bbd3758af77 · Note
• http://openwall.com/lists/oss-security/2014/04/07/7 · Note
• https://web.archive.org/web/20140705161237/http://fisheye.igniterealtime.org/changelog/openfiregit?cs=3aec383e07ee893b77396fe946766bbd3758af77 · Note
• http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas · Note