製品・ソフトウェアに関する情報

JVN脆弱性詳細

jappix の複数の XMPP クライアントの "XEP-0280: Message Carbons" の実装における連絡先を含むユーザになりすまされる脆弱性

Title	jappix の複数の XMPP クライアントの "XEP-0280: Message Carbons" の実装における連絡先を含むユーザになりすまされる脆弱性
Summary	jappix の複数の XMPP クライアントの "XEP-0280: Message Carbons" の実装には、連絡先を含むユーザになりすまされる脆弱性が存在します。
Possible impacts	リモートの攻撃者により、連絡先を含むユーザになりすまされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 27, 2017, midnight
Registration Date	March 8, 2017, 3:04 p.m.
Last Update	March 8, 2017, 3:04 p.m.

Affected System

Jappix

jappix 1.0.0 から 1.1.6

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-5602	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5602
National Vulnerability Database (NVD)
2	CVE-2017-5602	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5602
関連文書
3	CVE-2017-5589+ Multiple XMPP Clients User Impersonation Vulnerability	https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html
2	CWE-346	https://cwe.mitre.org/data/definitions/346.html

ベンダー情報

No	Name	URL
GitHub
1	Bump up to v1.1.7	https://github.com/jappix/jappix/commit/ea6de7c65b80880bdf85df47c1a8a5d3d68491af

Change Log

No	Changed Details	Date of change
0	[2017年03月08日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-5602

Summary	An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for jappix 1.0.0 to 1.1.6.
Publication Date	Feb. 10, 2017, 5:59 a.m.
Registration Date	Jan. 26, 2021, 1:26 p.m.
Last Update	Nov. 21, 2024, 12:27 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://openwall.com/lists/oss-security/2017/02/09/29	Exploit Mailing List Third Party Advisory
2	http://openwall.com/lists/oss-security/2017/02/09/29	Exploit Mailing List Third Party Advisory
3	http://www.securityfocus.com/bid/96176
4	http://www.securityfocus.com/bid/96176
5	https://github.com/jappix/jappix/commit/ea6de7c65b80880bdf85df47c1a8a5d3d68491af	Patch
6	https://github.com/jappix/jappix/commit/ea6de7c65b80880bdf85df47c1a8a5d3d68491af	Patch
7	https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/	Exploit Technical Description Third Party Advisory
8	https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/	Exploit Technical Description Third Party Advisory
9	https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf	Exploit Technical Description Third Party Advisory
10	https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf	Exploit Technical Description Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html
2	CWE-346	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html