Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions.

Gajim, a GTK+-based XMPP/Jabber client, unconditionally implements the 'XEP-0146: Remote Controlling Clients' extension, allowing a malicious XMPP server to trigger commands to leak private conversations from encrypted sessions. With this update XEP-0146 support has been disabled by default and made opt-in via the 'remote_commands' option.

Gajim 0.16.8

  - Fix rejoining MUCs after connection loss

  - Fix Groupchat invites

  - Fix encoding problems with newer GnuPG versions

  - Fix old messages randomly reappearing in the chat window

  - Fix some problems with IBB filetransfer

  - Make XEP-0146 Commands opt-in

  - Improve sending messages to your own resources

  - Improve reliability of delivery recipes

  - Many minor bugfixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201707-14 (Gajim: Information disclosure)

    Gajim unconditionally implements the &ldquo;XEP-0146: Remote Controlling       Clients&rdquo; extension.
  Impact :

    Remote attackers, by enticing a user to connect to a malicious XMPP       server, could extract plaintext from Off The Record (OTR) encrypted       sessions.
  Workaround :

    There is no known workaround at this time.

This update for gajim fixes the following issues :

  - CVE-2016-10376: XEP-0146 extension can be abused by     malicious XMPP servers (boo#1041163).

  - Update to version 0.16.7 :

  - Better compatibility with XEP-0191: Blocking Command.

  - Gajim now depends on python-gnupg for PGP encryption.

  - Remove usage of demandimport.

  - Many minor bugfixes.

  - Move python-farstream-0_1 to Suggests.

  - Correct the licence to GPL-3.0.

Gajim implements XEP-0146, an XMPP extension to run commands remotely from another client. However it was found that malicious servers can trigger commands, which could lead to leaking private conversations from encrypted sessions. To solve this, XEP-0146 support has been disabled by default.

For Debian 7 'Wheezy', these problems have been fixed in version 0.15.1-4.1+deb7u3.

We recommend that you upgrade your gajim packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
102483	Debian DSA-3943-1 : gajim - security update	Nessus	Debian Local Security Checks	medium
101739	Fedora 26 : gajim (2017-e6deec5bd0)	Nessus	Fedora Local Security Checks	medium
101345	GLSA-201707-14 : Gajim: Information disclosure	Nessus	Gentoo Local Security Checks	medium
100822	Fedora 24 : gajim (2017-62547837ba)	Nessus	Fedora Local Security Checks	medium
100821	Fedora 25 : gajim (2017-3c561780c8)	Nessus	Fedora Local Security Checks	medium
100710	openSUSE Security Update : gajim (openSUSE-2017-665)	Nessus	SuSE Local Security Checks	medium
100516	Debian DLA-967-1 : gajim security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2016-10376

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium