Vulnerability Details : CVE-2017-5589
Potential exploit
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android).
Vulnerability category: Input validation
Products affected by CVE-2017-5589
- cpe:2.3:a:yaxim:bruno:0.8.8:*:*:*:*:android:*:*
- cpe:2.3:a:yaxim:bruno:0.8.6:*:*:*:*:android:*:*
- cpe:2.3:a:yaxim:bruno:0.8.7:*:*:*:*:android:*:*
- cpe:2.3:a:yaxim:yaxim:0.8.8:*:*:*:*:android:*:*
- cpe:2.3:a:yaxim:yaxim:0.8.6:*:*:*:*:android:*:*
- cpe:2.3:a:yaxim:yaxim:0.8.7:*:*:*:*:android:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5589
0.31%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 70 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5589
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2017-5589
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
-
The product does not properly verify that the source of data or communication is valid.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5589
-
https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
Exploit;Technical Description;Third Party Advisory
-
https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
Page not found – rt-solutions.de – experts you can trustExploit;Technical Description;Third Party Advisory
-
http://openwall.com/lists/oss-security/2017/02/09/29
oss-security - CVE-2017-5589+ Multiple XMPP Clients User Impersonation VulnerabilityExploit;Mailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/96170
Yaxim and Bruno CVE-2017-5589 User Impersonation Vulnerability
-
https://github.com/ge0rg/yaxim/commit/65a38dc77545d9568732189e86089390f0ceaf9f
Smackable: improved carbon checks · ge0rg/yaxim@65a38dc · GitHubPatch
Jump to