The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.

This update of telepathy-gabble fixes a TLS bypass problem. Changes in telepathy-gabble :

  - Add telepathy-gabble-cve-2013-1431.patch (bnc#822586).
    This makes it respect the TLS-required flag on legacy     Jabber servers. Identified as CVE-2013-1431.

This release fixes a man-in-the-middle attack.

If you use an unencrypted connection to a 'legacy Jabber' (pre-XMPP) server, this version of Gabble will not connect until you make one of these configuration changes :

  - upgrade the server software to something that supports     XMPP 1.0; or

    - use an encrypted 'old SSL' connection, typically on       port 5223 (old-ssl); or

    - turn off 'Encryption required (TLS/SSL)'       (require-encryption)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Maksim Otstavnov discovered that telepathy-gabble incorrectly handled TLS when connecting to legacy jabber servers. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. (CVE-2013-1431)

It was discovered that telepathy-gabble incorrectly handled certain messages. A remote attacker could use this flaw to cause applications using telepathy-gabble to crash, resulting in a denial of service.
This issue only affected Ubuntu 12.04 LTS and Ubuntu 12.10.
(CVE-2013-1769).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Simon McVittie reports :

This release fixes a man-in-the-middle attack.

If you use an unencrypted connection to a 'legacy Jabber' (pre-XMPP) server, this version of Gabble will not connect until you make one of these configuration changes :

. upgrade the server software to something that supports XMPP 1.0; or

. use an encrypted 'old SSL' connection, typically on port 5223 (old-ssl); or

. turn off 'Encryption required (TLS/SSL)' (require-encryption).

Maksim Otstavnov discovered that the Wocky submodule used by telepathy-gabble, the Jabber/XMPP connection manager for the Telepathy framework, does not respect the tls-required flag on legacy Jabber servers. A network intermediary could use this vulnerability to bypass TLS verification and perform a man-in-the-middle attack.

ID	Name	Product	Family	Severity
75033	openSUSE Security Update : telepathy-gabble (openSUSE-SU-2013:1013-1)	Nessus	SuSE Local Security Checks	medium
67382	Fedora 18 : telepathy-gabble-0.16.6-1.fc18 (2013-9794)	Nessus	Fedora Local Security Checks	medium
66886	Ubuntu 12.04 LTS / 12.10 / 13.04 : telepathy-gabble vulnerabilities (USN-1873-1)	Nessus	Ubuntu Local Security Checks	medium
66815	FreeBSD : telepathy-gabble -- TLS verification bypass (a3c2dee5-cdb9-11e2-b9ce-080027019be0)	Nessus	FreeBSD Local Security Checks	medium
66792	Debian DSA-2702-1 : telepathy-gabble - TLS verification bypass	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-1431

high

Tenable Plugins

medium

medium

medium

medium

medium