Ubuntu.comUB:CVE-2017-5591CVE-2017-5591
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
65.4%
An incorrect implementation of “XEP-0280: Message Carbons” in multiple XMPP
clients allows a remote attacker to impersonate any user, including
contacts, in the vulnerable application’s display. This allows for various
kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1
and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and
other products.
Bugs
References
openwall.com/lists/oss-security/2017/02/09/29
github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8
launchpad.net/bugs/cve/CVE-2017-5591
nvd.nist.gov/vuln/detail/CVE-2017-5591
rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
security-tracker.debian.org/tracker/CVE-2017-5591
www.cve.org/CVERecord?id=CVE-2017-5591
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
65.4%