ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.

Andreas Kurtz reports :

The jabber server Openfire (<= version 3.6.0a) contains several serious vulnerabilities. Depending on the particular runtime environment these issues can potentially even be used by an attacker to execute code on operating system level.

- Authentication bypass - This vulnerability provides an attacker full access to all functions in the admin webinterface without providing any user credentials. The Tomcat filter which is responsible for authentication could be completely circumvented.

- SQL injection - It is possible to pass SQL statements to the backend database through a SQL injection vulnerability. Depending on the particular runtime environment and database permissions it is even possible to write files to disk and execute code on operating system level.

- Multiple Cross-Site Scripting - Permits arbitrary insertion of HTML- and JavaScript code in login.jsp. An attacker could also manipulate a parameter to specify a destination to which a user will be forwarded to after successful authentication.

Secunia reports :

A vulnerability has been reported in Openfire, which can be exploited by malicious people to cause a Denial of Service.

The vulnerability is caused due to an unspecified error and can be exploited to cause a Denial of Service.

The remote host is affected by the vulnerability described in GLSA-200804-26 (Openfire: Denial of Service)

    Openfire's connection manager in the file ConnectionManagerImpl.java     cannot handle clients that fail to read messages, and has no limit on     their session's send buffer.
  Impact :

    Remote authenticated attackers could trigger large outgoing queues     without reading messages, causing a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote host is running Openfire / Wildfire, an instant messaging server that supports the XMPP protocol.  According to its version, the installation of Openfire or Wildfire on the remote host suffers from an unspecified denial of service vulnerability that could bring the server down.

The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol.

According to its version, the installation of Openfire or Wildfire on the remote host suffers from a denial of service vulnerability that could bring the server down because it has no limit on a client session's send buffer and can not handle clients that fail to read messages.

ID	Name	Product	Family	Severity
34839	FreeBSD : openfire -- multiple vulnerabilities (937adf01-b64a-11dd-a55e-00163e000016)	Nessus	FreeBSD Local Security Checks	high
32069	FreeBSD : openfire -- unspecified denial of service (b84a992a-12ab-11dd-bab7-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium
32046	GLSA-200804-26 : Openfire: Denial of Service	Nessus	Gentoo Local Security Checks	medium
4463	Openfire < 3.5.0 Queue Handling Remote DoS	Nessus Network Monitor	CGI	low
31855	Openfire < 3.5.0 ConnectionManagerImpl.java Queue Handling Remote DoS	Nessus	Denial of Service	high

Detections

Analytics

CVE-2008-1728

medium

Tenable Plugins

high

medium

medium

low

high