[SA16291] jabberd "jid.c" Buffer Overflow Vulnerabilities

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

FreeBSD : jabberd -- 3 buffer overflows (55041d37-ff62-11d9-a9a5-000ae4641456)

There are 3 buffer overflows in jid.c that are triggered during parsing of JID strings when components user, host or resource are too long. - jid.c, line 103: overflow in str' buffer through strcpy when 'user' part is too long. - jid.c, line 115: overflow in str' buffer through strcpy when 'host'...

FreeBSD : jabberd -- remote buffer overflow vulnerability (553224e7-4325-11d9-a3d5-000c6e8f12ef)

Caused by improper bounds-checking of username and password in the C2S module, it is possible for an attacker to cause a remote buffer overflow. The server directly handles the userinput with SQL backend functions - malicious input may lead to buffer overflow. %NASLMINLEVEL 70300 C Tenable Networ...

FreeBSD : jabberd -- denial-of-service vulnerability (2e25d38b-54d1-11d9-b612-000c6e8f12ef)

Jose Antonio Calvo discovered a bug in the Jabber 1.x server. According to Matthias Wimmer : Without this patch, it is possible to remotly crash jabberd14, if there is access to one of the following types of network sockets : - Socket accepting client connections - Socket accepting connections fr...

CVE-2004-1378: Undefined Security Weakness

The expat XML parser code, as used in the open source Jabber jabberd 1.4.3 and earlier, jadc2s 0.9.0 and earlier, and possibly other packages, allows remote attackers to cause a denial of service application crash via a malformed packet to a socket that accepts XML connections...

CVE-2004-0953

CVE-2004-0953 affects Jabberd (Jabberd 2.x) within the C2S component. The vulnerability is a remote buffer overflow in the C2S/authreg path that handles the username (and realm) without proper length checks, leading to possible denial of service or code execution when a long username is supplied....

CVE-2004-0953: Undefined Security Weakness

Buffer overflow in the C2S module in the open source Jabber 2.x server Jabberd allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a long username...

[Full-Disclosure] Jabberd2.x remote BuffJabberd2.x remote Buffer Overflowser Overflows

Security Advisory Advisory: ADLAB-04002Jabberd2.x remote Buffer Overflows Authors: [email protected] Class: Boundary Condition Error CVE:CAN-2004-0953 Remote: Yes, could allow remote compromise Vulnerable: Jabberd 2. Unvulnerable: Jabberd 1.4 Vendor: http://jabberd.jabberstudio.org/ I.INFO:...

jabberd buffer overflow

Buffer overflow on oversized username...

jabberd -- remote buffer overflow vulnerability

Caused by improper bounds-checking of username and password in the C2S module, it is possible for an attacker to cause a remote buffer overflow. The server directly handles the userinput with SQL backend functions - malicious input may lead to buffer overflow...

Possible DoS attack against jabberd 1.4.3 and jadc2s 0.9.0

jabberd up to and including version 1.4.3 and jadc2s up to and including version 0.9.0 are vulnerable against a DoS attack reported by Jose Antonio Calvo yesterday on the jabberd mailing list. http://jabberstudio.org/pipermail/jabberd/2004-September/002004.html An attacker can crash a running...

GLSA-200409-31 : jabberd 1.x: Denial of Service vulnerability

The remote host is affected by the vulnerability described in GLSA-200409-31 jabberd 1.x: Denial of Service vulnerability Jose Antonio Calvo found a defect in routines handling XML parsing of incoming data. jabberd 1.x may crash upon reception of invalid data on any socket connection on which XML...

jabberd 1.x: Denial of Service vulnerability

Background Jabber is a set of streaming XML protocols enabling message, presence, and other structured information exchange between two hosts. jabberd is the original implementation of the Jabber protocol server. Description Jose Antonio Calvo found a defect in routines handling XML parsing of...

jabberd -- denial-of-service vulnerability

José Antonio Calvo discovered a bug in the Jabber 1.x server. According to Matthias Wimmer: Without this patch, it is possible to remotly crash jabberd14, if there is access to one of the following types of network sockets: Socket accepting client connections Socket accepting connections from oth...