The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute.

The remote Solaris system is missing necessary patches to address security updates :

  - The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8     and 3.0.0-alpha-3 allows remote authenticated users to     cause a denial of service (infinite loop) via a stanza     with a publish tag that lacks a node attribute.
    (CVE-2011-4320)

  - The TLS driver in ejabberd before 2.1.12 supports (1)     SSLv2 and (2) weak SSL ciphers, which makes it easier     for remote attackers to obtain sensitive information via     a brute-force attack. (CVE-2013-6169)

The remote host is affected by the vulnerability described in GLSA-201206-10 (ejabberd: Multiple Denial of Service vulnerabilities)

    Multiple vulnerabilities have been discovered in ejabberd. Please review       the CVE identifiers referenced below for details.
  Impact :

    ejabberd allows remote attackers to cause a Denial of Service condition       with the result of either crashing the daemon or the whole system by       causing memory and CPU consumption.
  Workaround :

    There is no known workaround at this time.

- Ver. 2.1.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80601	Oracle Solaris Third-Party Patch Update : ejabberd (cve_2013_6169_cryptographic_issues)	Nessus	Solaris Local Security Checks	medium
59648	GLSA-201206-10 : ejabberd: Multiple Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	medium
57325	Fedora 15 : ejabberd-2.1.9-1.fc15 (2011-16282)	Nessus	Fedora Local Security Checks	medium
57324	Fedora 16 : ejabberd-2.1.9-1.fc16 (2011-16281)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-4320

medium

Tenable Plugins

medium

medium

medium

medium