nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the
    processing of compressed XML elements, which allows remote attackers to cause a denial of service
    (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. (CVE-2014-2741)

The remote host is running a version of Openfire prior to 3.9.2. It is, therefore, affected by an XMPP-layer denial of service vulnerability.

The vulnerability exists in 'nio/XMLLightweightParser.java' which fails to properly restrict the processing of compressed XML elements, which allows remote attackers to consume resources via a crafted XMPP stream, known as an 'xmppbomb' attack.

The remote host is affected by the vulnerability described in GLSA-201406-35 (Openfire: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Openfire. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition or       bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
434984	SCA: security update for org.igniterealtime.openfire:parent (GHSA-j5qh-cp3p-2h87)	Tenable Cloud Security	SCA Checks	Local	high
434984	SCA: security update for org.igniterealtime.openfire:parent (GHSA-j5qh-cp3p-2h87)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
76494	Openfire < 3.9.2 XMPP-Layer DoS	Nessus	CGI abuses	Remote	high
76330	GLSA-201406-35 : Openfire: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high

Detections

Analytics

CVE-2014-2741

high

Tenable Plugins

high

high

high

high