XMPP Makes Encryption Mandatory for Instant Messaging Service Operators

The most popular open source Instant messaging application based on the ‘Extensible Messaging and Presence Protocol’ XMPP, formerly known as Jabber that enables you to connect with other people over the Internet will begin refusing unencrypted connections as from today. In an announcement...

XMPP Mandating Encryption on Messaging Service Operators

Beginning today, the operators of instant messaging services that rely on the extensible messaging and presence protocol XMPP are expected to deploy encryption into the platforms they maintain. The XMPP Standard Foundation XSF announced today that a large number of services on the public XMPP...

[SECURITY] [DSA 2895-1] prosody security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2895-1 [email protected] http://www.debian.org/security/ Luciano Bello April 06, 2014 http://www.debian.org/security/faq -...

Fedora Update for prosody FEDORA-2014-5586

Check for the Version of prosody OpenVAS Vulnerability Test Fedora Update for prosody FEDORA-2014-5586 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora 19 : prosody-0.8.2-11.fc19 (2014-5586)

Added upstream patches to avoid resource consumption denial of service when using XMPP application-layer compression 1085692 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean an...

[SECURITY] Fedora 19 Update: prosody-0.8.2-11.fc19

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

CVE-2014-0364

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...

Design/Logic Flaw

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...

Design/Logic Flaw

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2014-0364

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...

CVE-2014-0364

CVE-2014-0364 affects Ignite Realtime Smack XMPP API: the ParseRoster component does not verify the From attribute of a roster-query IQ stanza, enabling remote spoofing of IQ responses. Documented in multiple sources (NVD entry and vendor advisories) and corroborated by Red Hat and IBM security b...

CVE-2014-0364

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...

CVE-2014-0363

CVE-2014-0363 affects Ignite Realtime Smack XMPP API: ServerTrustManager fails to verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, enabling MITM spoofing of servers and potential data leakage. The vulnerability is in the Smack API prior to 4.0.0-rc1. Remed...

CVE-2014-0363

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2014-0363: Improper Certificate Validation

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

PT-2014-3593

Name of the Vulnerable Software and Affected Versions Smack XMPP API versions prior to 4.0.0-rc1 Description The issue concerns the ParseRoster component, which fails to verify the from attribute of a roster-query IQ stanza. This allows remote attackers to spoof IQ responses by crafting a malicio...

PT-2014-3592

Name of the Vulnerable Software and Affected Versions Smack XMPP API versions prior to 4.0.0-rc1 Description The issue concerns the ServerTrustManager component, which fails to verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers. This allows attackers to spoof...

CVE-2014-0364: Insufficient Verification of Data Authenticity

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...

Ignite Realtime Smack XMPP API contains multiple vulnerabilities

Overview Ignite Realtime's Smack XMPP API ServerTrustManger trusts unauthorized SSL certificates CWE-358 and IQ requests do not verify the from attribute allowing anyone to spoof IQ responses. CWE-345 Description CWE-358:Improperly Implemented Security Check for Standard- CVE-2014-0363 The...

SSL/TLS: XMPP 'STARTTLS' Extension Detection

Checks if the remote XMPP server/client supports SSL/TLS with the Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...