CVE-2014-5075 – smack: MitM vulnerability

https://notcve.org/view.php?id=CVE-2014-5075

The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. La API Ignite Realtime Smack XMPP 4.x anterior a 4.0.2, y 3.x y 2.x cuando se utiliza un SSLContext personalizado, no verifica que el nombre del servidor coincide con un nombre de dominio en el campo de asunto Common Name (CN) o subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle suplantar los servidores SSL a través de un certificado válido arbitrario. It was found that SSLSocket in Smack did not perform hostname verification. An attacker could redirect traffic between an application and an XMPP server by providing a valid certificate for a domain under the attacker's control. • http://op-co.de/CVE-2014-5075.html http://rhn.redhat.com/errata/RHSA-2015-1176.html http://secunia.com/advisories/59915 http://www.securityfocus.com/bid/69064 https://access.redhat.com/security/cve/CVE-2014-5075 https://bugzilla.redhat.com/show_bug.cgi?id=1127276 • CWE-310: Cryptographic Issues •