Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Issues

Go to all issues
Select view

Select search mode

 
50 of 900

Smack starts SASL step without TLS in case STARTTLS is stripped even if SecurityMode.Required is used

Fixed

Description

Summary

Smack prior 4.1.9 is vulnerable to "Strip STARTTLS" kind of attacks. A network attacker could use this to mount a Man-in-the-Middle attack on TLS secured connections. This is [https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10027|CVE-2016-10027].

Further Details

  • Requires the server to announce SASL mechanisms in case the server requires TLS. But this is trivial to do by MitM injection, although most "Strip STARTTLS" tools don't do it. If they do, an attacker would also be able to gain access to the initial response data of SASL. In case of SASL PLAIN, this would be the plain text secrect/password.

  • The underlying faulty implementation is as old as 8e750912a765f77a4f178a4f307a8b42c2afb5ae, maybe even older.

Quick Fix

A simple workaround may be checking the return value of isSecureConnection() between the calls of connect() and login(). For example if you currently have

XMPPTCPConnection connection = ... connection.connect().login();

then change this to

XMPPTCPConnection connection = ... connection.connect(); if (!connection.isSecureConnection() && connection.getConfiguration().getSecurityMode() == SecurityMode.Required) { connection.instantShutdown(); throw new SecurityRequiredByClientException(); } connection.login();

Timeline

Date

 

2016-11-10

Reported to security@igniterealtime.org

2016-11-11

Verified, requested CVE and prepared fix

2016-11-15

Fix tested

2016-11-19

Released Smack 4.1.9 with fix to Maven Central

2016-11-22

Public Smack Security Advisory

2016-12-09

Made https://igniterealtime.atlassian.net/browse/SMACK-739#icft=SMACK-739 public

Environment

None

Details

Assignee

Reporter

Labels

Expected Effort

Medium

Components

Fix versions

Affects versions

Priority

Created November 11, 2016 at 6:07 PM
Updated January 13, 2017 at 7:10 PM
Resolved November 19, 2016 at 1:24 PM

Activity

Show:

Flag notifications