PT-2017-16596 · Sleekxmpp+3 · Sleekxmpp+3

Published 2017-02-09 · Updated 2022-05-13 · CVE-2017-5591

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SleekXMPP versions 1.3.1 and earlier Slixmpp versions 1.2.3 and earlier poezio versions 0.8 through 0.10

Description The issue is related to an incorrect implementation of XEP-0280: Message Carbons in multiple XMPP clients. This allows a remote attacker to impersonate any user in the vulnerable application's display, enabling various kinds of social engineering attacks.

Recommendations For SleekXMPP versions 1.3.1 and earlier, update to a version later than 1.3.1. For Slixmpp versions 1.2.3 and earlier, update to a version later than 1.2.3. For poezio versions 0.8 through 0.10, update to a version later than 0.10.

Exploit

Fix

RCE

Origin Validation Error

Weakness Enumeration

CWE-20

CWE-940

CWE-346

Related Identifiers

ALT-PU-2017-1284

CVE-2017-5591

GHSA-C35G-JR5F-H83P

PYSEC-2017-103

PYSEC-2017-104

Affected Products

Alt Linux

Sleekxmpp

Slixmpp

Poezio

References · 26

• 🔥 https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf · Exploit
• 🔥 https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons · Exploit
• 🔥 http://openwall.com/lists/oss-security/2017/02/09/29 · Exploit
• https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5591 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5591 · Security Note
• https://osv.dev/vulnerability/GHSA-c35g-jr5f-h83p · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5591 · Security Note
• https://ubuntu.com/security/CVE-2017-5591 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5591 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-103 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1284 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5591 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-5591 · Vendor Advisory