CVE-2017-5603

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.
Severity
MEDIUM
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Atk. Vector
NETWORK
Atk. Complexity
HIGH
Priv. Required
NONE
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
VendorProductVersion
jitsijitsi
2.5.5061
jitsijitsi
2.9.5544
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jitsi
cosmic
dne
bionic
dne
artful
dne
zesty
dne
yakkety
dne
xenial
dne
trusty
dne
precise
dne
Common Weakness Enumeration
References
http://openwall.com/lists/oss-security/2017/02/09/29
http://www.securityfocus.com/bid/96174
https://github.com/jitsi/jitsi/commit/7d66da61b316c9480b63000f831b6de723b87315
https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf
http://openwall.com/lists/oss-security/2017/02/09/29
http://www.securityfocus.com/bid/96174
https://github.com/jitsi/jitsi/commit/7d66da61b316c9480b63000f831b6de723b87315
https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/
https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf