Short Name |
CHAT:JABBER:UNAME-OF |
---|---|
Severity |
Major |
Recommended |
No |
Recommended Action |
Drop |
Category |
CHAT |
Keywords |
Jabber 2.x Username Buffer Overflow |
Release Date |
2004/12/17 |
Update Number |
1213 |
Supported Platforms |
idp-4.1+, isg-3.5+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
This signature detects attempts to overflow the username field in cleartext XMPP communications. Jabberd 2.x incorrectly verifies the username field length, enabling a malicious user to overflow a buffer. When Jabberd is running as root, an attacker can also execute arbitrary code.
Multiple remote buffer overflow vulnerabilities affect the Jabber Server. These issues are due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into finite process buffers. An attacker may leverage these issues to execute arbitrary code on a computer with the privileges of the server process. This may facilitate unauthorized access or privilege escalation.