Miranda IM silent TLS failure

Type securityvulns
Reporter Securityvulns
Modified 2010-03-18T00:00:00


Summary: Under certain conditions, Miranda ignores the "Use TLS" setting in Jabber accounts and uses an unencrypted connection.

Affected: Miranda IM (instant messenger), at least versions 0.8.16, 0.9.0 alpha build #6 Unicode and SVN rev. 11383

Description: If the following conditions are met: - "Use TLS" is enabled in the jabber account settings (Network - Jabber - Account),

  • "Validate SSL certificates" is enabled in the Network settings

  • "Disable SASL authentication" is enabled in the advanced jabber settings (Network - Jabber - Advanced, Miscellaneous - Server options)

Miranda will silently connect to the server without using TLS, sending all data in plain.

Impact: This issue allows eavesdropping and impersonation attacks on the connection to the XMPP/Jabber server, even if "Use TLS" is enabled and the user assumes the connection to be secure.

Workaround: Uncheck "Disable SASL authentication" and restart Miranda. Make sure the server certificate is trusted (via the Windows certificate store), or your connections will fail.

Disclosure: The bug was reported to the authors via their bug tracker.

I disclose the issue to the public without waiting for a patch because

a) no harm is expected from public knowledge of this issue, even as no patch exists

b) an easy workaround (fixing the settings) exists

It seems that this issue was already reported by another user in 2009: http://code.google.com/p/miranda/issues/detail?id=152

According to that, the "Disable SASL" setting suppresses TLS and no warning is given to the user.

Fix: Ensure that if "Use TLS" is checked, failure to establish a TLS-secured connection is a fatal error. No data should be transferred and the user should be warned about this.

Additionally, make "Use TLS" and "Disable SASL" mutually exclusive and change the misleading name of the "Disable SASL" setting.

written by: Jan Schejbal

Thanks to Protogenes and Nico Haase for testing and confirming the issue.

Kind regards, Jan Schejbal