CVE

Id
87520  
CVE No.
CVE-2016-10027  
Status
Candidate  
Description
Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.  
Phase
Assigned (20161222)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
763893 87520 CVE-2016-10027 MLIST:[oss-security] 20161222 Re: CVE Request: Smack: TLS SecurityMode.required not always enforced, leading to striptls attack  View
763894 87520 CVE-2016-10027 URL:http://www.openwall.com/lists/oss-security/2016/12/22/12  View
763895 87520 CVE-2016-10027 CONFIRM:https://community.igniterealtime.org/blogs/ignite/2016/11/22/smack-security-advisory-2016-11-22  View
763896 87520 CVE-2016-10027 CONFIRM:https://github.com/igniterealtime/Smack/commit/059ee99ba0d5ff7758829acf5a9aeede09ec820b  View
763897 87520 CVE-2016-10027 CONFIRM:https://github.com/igniterealtime/Smack/commit/a9d5cd4a611f47123f9561bc5a81a4555fe7cb04  View
763898 87520 CVE-2016-10027 CONFIRM:https://issues.igniterealtime.org/projects/SMACK/issues/SMACK-739  View
763899 87520 CVE-2016-10027 FEDORA:FEDORA-2016-897a1e6698  View
763900 87520 CVE-2016-10027 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4WXAZ4JVJXHMEDDXJVWJHPVBF5QCTZF/  View
763901 87520 CVE-2016-10027 BID:95129  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
1186 JVNDB-2016-001959 Adobe Flash Player における権限を取得される脆弱性 Adobe Flash Player には、検索パスに関する処理に不備があるため、権限を取得される脆弱性が存在します。 CVE-2016-1014 87520 7.2 7.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001959.html  View