JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.

The remote host is affected by the vulnerability described in GLSA-201803-07 (JabberD 2.x: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Gentoo&rsquo;s JabberD 2.x       ebuild. Please review the referenced CVE identifiers for details.
  Impact :

    An attacker could possibly escalate privileges by owning system binaries       in trusted locations, cause a Denial of Service condition by manipulating       the PID file from jabberd2 services, bypass security via SASL ANONYMOUS       connections or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

SecurityFocus reports :

JabberD is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks.

updated to 2.6.1 (security bugfix release)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that jabberd2, a Jabber instant messenger server, allowed anonymous SASL connections, even if disabled in the configuration.

ID	Name	Product	Family	Severity
108433	GLSA-201803-07 : JabberD 2.x: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
102010	FreeBSD : jabberd -- authentication bypass vulnerability (76d80b33-7211-11e7-998a-08606e47f965)	Nessus	FreeBSD Local Security Checks	critical
101874	Fedora 24 : jabberd (2017-f6361db8fd)	Nessus	Fedora Local Security Checks	critical
101777	Fedora 25 : jabberd (2017-9dd1004ad8)	Nessus	Fedora Local Security Checks	critical
101604	Fedora 26 : jabberd (2017-313712a583)	Nessus	Fedora Local Security Checks	critical
101240	Debian DSA-3902-1 : jabberd2 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-10807

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical