1. CVE-Search
  2. CVE-2014-5075
ID CVE-2014-5075
Summary The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
References
Vulnerable Configurations
  • cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:jboss_fuse:6.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:jboss_fuse:6.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:jboss_fuse:6.1.0:beta:*:*:*:*:*:*
    cpe:2.3:a:redhat:jboss_fuse:6.1.0:beta:*:*:*:*:*:*
  • cpe:2.3:a:igniterealtime:smack_api:4.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:igniterealtime:smack_api:4.0.1:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 28-11-2016 - 19:12)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
redhat via4
advisories
rhsa
id RHSA-2015:1176
refmap via4
bid 69064
confirm http://op-co.de/CVE-2014-5075.html
secunia 59915
Last major update 28-11-2016 - 19:12
Published 25-10-2014 - 21:55
Last modified 28-11-2016 - 19:12
Back to Top