Lucene search

[email protected]CVE-2017-5590

HistoryFeb 09, 2017 - 8:59 p.m.

CVE-2017-5590

2017-02-0920:59:00

CWE-20

CWE-346

[email protected]

web.nvd.nist.gov

cve-2017-5590

xep-0280

message carbons

xmpp clients

remote attacker

user impersonation

social engineering

chatsecure

zom

ios

vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

5.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.6%

JSON

An incorrect implementation of “XEP-0280: Message Carbons” in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application’s display. This allows for various kinds of social engineering attacks. This CVE is for ChatSecure (3.2.0 - 4.0.0; only iOS) and Zom (all versions up to 1.0.11; only iOS).

Affected configurations

NVD

Node

chatsecurechatsecureMatch3.2.0iphone_os

chatsecurechatsecureMatch3.2.1iphone_os

chatsecurechatsecureMatch3.2.2iphone_os

chatsecurechatsecureMatch3.2.3iphone_os

chatsecurechatsecureMatch4.0.0iphone_os

Node

zomzomRange≤1.0.11iphone_os

CPENameOperatorVersion
chatsecure:chatsecurechatsecureeq3.2.0
chatsecure:chatsecurechatsecureeq3.2.1
chatsecure:chatsecurechatsecureeq3.2.2
chatsecure:chatsecurechatsecureeq3.2.3
chatsecure:chatsecurechatsecureeq4.0.0

CPE	Name	Operator	Version
chatsecure:chatsecure	chatsecure	eq	3.2.0
chatsecure:chatsecure	chatsecure	eq	3.2.1
chatsecure:chatsecure	chatsecure	eq	3.2.2
chatsecure:chatsecure	chatsecure	eq	3.2.3
chatsecure:chatsecure	chatsecure	eq	4.0.0

References

openwall.com/lists/oss-security/2017/02/09/29

www.securityfocus.com/bid/96165

github.com/ChatSecure/ChatSecure-iOS/commit/a340b4bb519227d89f85f2716a10a197a65d4856

github.com/zom/Zom-iOS/commit/880051eaa8ba32d1b257c87a7d8798a93561bfd3

rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/

rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

5.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.6%

JSON

Related for CVE-2017-5590

nvd1 prion1 cvelist1 osv1