NVD Vulnerability Detail

CVE-2017-5590

Summary	An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for ChatSecure (3.2.0 - 4.0.0; only iOS) and Zom (all versions up to 1.0.11; only iOS).
Publication Date	Feb. 10, 2017, 5:59 a.m.
Registration Date	Jan. 26, 2021, 1:26 p.m.
Last Update	Nov. 21, 2024, 12:27 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:chatsecure:chatsecure:3.2.1:::::iphone_os::
cpe:2.3:a:chatsecure:chatsecure:3.2.3:::::iphone_os::
cpe:2.3:a:chatsecure:chatsecure:4.0.0:::::iphone_os::
cpe:2.3:a:chatsecure:chatsecure:3.2.2:::::iphone_os::
cpe:2.3:a:chatsecure:chatsecure:3.2.0:::::iphone_os::

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:zom:zom::::::iphone_os::*			1.0.11

Related information, measures and tools

No	URL	タグ
1	http://openwall.com/lists/oss-security/2017/02/09/29	Exploit Mailing List Third Party Advisory
2	http://openwall.com/lists/oss-security/2017/02/09/29	Exploit Mailing List Third Party Advisory
3	http://www.securityfocus.com/bid/96165
4	http://www.securityfocus.com/bid/96165
5	https://github.com/ChatSecure/ChatSecure-iOS/commit/a340b4bb519227d89f85f2716a10a197a65d4856	Patch
6	https://github.com/ChatSecure/ChatSecure-iOS/commit/a340b4bb519227d89f85f2716a10a197a65d4856	Patch
7	https://github.com/zom/Zom-iOS/commit/880051eaa8ba32d1b257c87a7d8798a93561bfd3	Patch
8	https://github.com/zom/Zom-iOS/commit/880051eaa8ba32d1b257c87a7d8798a93561bfd3	Patch
9	https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/	Exploit Technical Description Third Party Advisory
10	https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/	Exploit Technical Description Third Party Advisory
11	https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf	Exploit Technical Description Third Party Advisory
12	https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf	Exploit Technical Description Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html
2	CWE-346	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

ChatSecure および Zom の複数の XMPP クライアントの "XEP-0280: Message Carbons" の実装における連絡先を含むユーザになりすまされる脆弱性

Title	ChatSecure および Zom の複数の XMPP クライアントの "XEP-0280: Message Carbons" の実装における連絡先を含むユーザになりすまされる脆弱性
Summary	ChatSecure および Zom の複数の XMPP クライアントの "XEP-0280: Message Carbons" の実装には、連絡先を含むユーザになりすまされる脆弱性が存在します。
Possible impacts	リモートの攻撃者により、連絡先を含むユーザになりすまされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 24, 2017, midnight
Registration Date	March 8, 2017, 7:10 p.m.
Last Update	March 8, 2017, 7:10 p.m.

Affected System

ChatSecure

ChatSecure 3.2.0 から 4.0.0 (iOS)

Zom

Zom 1.0.11 まで (iOS)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-5590	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5590
National Vulnerability Database (NVD)
2	CVE-2017-5590	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5590
関連文書
3	CVE-2017-5589+ Multiple XMPP Clients User Impersonation Vulnerability	https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html
2	CWE-346	https://cwe.mitre.org/data/definitions/346.html

ベンダー情報

No	Name	URL
GitHub
1	Updated chatsecure	https://github.com/zom/Zom-iOS/commit/880051eaa8ba32d1b257c87a7d8798a93561bfd3

Change Log

No	Changed Details	Date of change
0	[2017年03月08日] 掲載	Feb. 17, 2018, 10:37 a.m.