[Bug 1127276] New: CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Bug ID: 1127276
           Summary: CVE-2014-5075 smack: MitM vulnerability
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail]

It was reported [1] that Smack (XMPP client library) is vulnerable to MitM
attacks with a crafted SSL certificates.
Quote from [1]:
...
Details
-------

Smack is using Java's `SSLSocket`, which checks the peer certificate
using an `X509TrustManager`, but does not perform hostname verification.
Therefore, it is possible to redirect the traffic between a Smack-using
application and a legitimate XMPP server through the attacker's server,
merely by providing a valid certificate for a domain under the
attacker's control.

In Smack versions 2.2.0 to 3.4.1, a custom `ServerTrustManager`
implementation was used, which was supplied with the connection's server
name, and performed hostname verification. However, it failed to verify
the basicConstraints and nameConstraints of the certificate chain
(CVE-2014-0363, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0363)
and has been removed in Smack 4.0.0.

Applications using Smack 2.2.0 to 3.4.1 with a custom `TrustManager` did
not benefit from `ServerTrustManager` and are vulnerable as well, unless
their own `TrustManager` implementation explicitly performs hostname
verification.
...

[1]: http://seclists.org/bugtraq/2014/Aug/29

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Vasyl Kaigorodov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1127277

--- Comment #1 from Vasyl Kaigorodov  ---

Created smack tracking bugs for this issue:

Affects: fedora-all [bug 1127277]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1127277
[Bug 1127277] CVE-2014-5075 smack: MitM vulnerability [fedora-all]

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Vasyl Kaigorodov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1127281

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Arun Babu Neelicattu  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=moderate,public=2014 |impact=moderate,public=2014
                   |0805,reported=20140806,sour |0805,reported=20140806,sour
                   |ce=bugtraq,cvss2=5.8/AV:N/A |ce=bugtraq,cvss2=5.8/AV:N/A
                   |C:M/Au:N/C:P/I:P/A:N,fedora |C:M/Au:N/C:P/I:P/A:N,fedora
                   |-all/smack=affected,brms-5/ |-all/smack=affected,brms-5/
                   |smack=new,jboss/fuse-6=new, |smack=new,jboss/fuse-6=new,
                   |jboss/fuse-esb=new          |jboss/fuse-esb-7=new

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Arun Babu Neelicattu  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Arun Babu Neelicattu  ---
References:

http://seclists.org/bugtraq/2014/Aug/29

Upstream Issue:

https://igniterealtime.org/issues/browse/SMACK-586

Upstream Commits:

http://fisheye.igniterealtime.org/changelog/smackgit?cs=057d00c9de04d576db40...

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Arun Babu Neelicattu  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|4.0.2                       |smack-core 4.0.2, smack-tcp
                   |                            |4.0.2, smack 4.0.2

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276
Bug 1127276 depends on bug 1127277, which changed state.

Bug 1127277 Summary: CVE-2014-5075 smack: MitM vulnerability [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1127277

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

--- Comment #3 from Fedora Update System  ---
smack-3.2.2-5.fc20 has been pushed to the Fedora 20 stable repository.  If
problems still persist, please make note of it in this bug report.

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Pavel Polischouk  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=moderate,public=2014 |impact=moderate,public=2014
                   |0805,reported=20140806,sour |0805,reported=20140806,sour
                   |ce=bugtraq,cvss2=5.8/AV:N/A |ce=bugtraq,cvss2=5.8/AV:N/A
                   |C:M/Au:N/C:P/I:P/A:N,fedora |C:M/Au:N/C:P/I:P/A:N,fedora
                   |-all/smack=affected,brms-5/ |-all/smack=affected,brms-5/
                   |smack=new,jboss/fuse-6=new, |smack=wontfix,jboss/fuse-6=
                   |jboss/fuse-esb-7=new        |new,jboss/fuse-esb-7=new

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Chess Hazlett  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Chess Hazlett  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1232965

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

--- Doc Text *updated* by Chess Hazlett  ---
It was found that SSLSocket in Smack did not perform hostname verification. An attacker could redirect traffic between an application and an XMPP server by providing a valid certificate for a domain under the attacker's control.

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

--- Comment #5 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Via RHSA-2015:1176 https://rhn.redhat.com/errata/RHSA-2015-1176.html

[Bug 1127276] CVE-2014-5075 smack: MitM vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1127276

Chess Hazlett  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2016-01-21 16:04:49