xmpp cleartext authentication exploit

needed when host name cannot be automatically determined (eg.

Possible exploit scenario.

... an API call over an unencrypted HTTP connection, and expects it to have the username and password in the clear. Let's say you run an XMPP service for example.net (jids of user@example.net), you will need to order a certificate for with a subject or alt-name of example.net (not server.example.net) from your preferred cert provider. View Bug Details in Bug Search Tool.

xmpp-brute.servername . Bug details contain sensitive information and therefore require a Cisco.com account to be viewed. This vulnerability is due to the XMPP service incorrectly processing an unsecured HTTP port for 3rd party remote presence monitoring. Hence, it is recommended to disable clear text authentication mechanism in the XMPP configuration. In fact, this is only an exploit against design flaws of some XMPP clients that would not warn the user that they are about to send their credentials on a clear text channel. Applications that fail to adequately encrypt network traffic using strong cryptography are at increased risk of being compromised and exposing cardholder data.

The remote Extensible Messaging and Presence Protocol (XMPP) service supports one or more authentication mechanisms that allow credentials to be sent in the clear. when running against an IP, instead of hostname) xmpp-brute.auth . "The remote Extensible Messaging and Presence Protocol (XMPP) service supports one or more authentication mechanisms that allow credentials to be sent in the clear. Credentials sent as cleartext Description. The security field defines that the API is protected with basic authentication (username and password). authentication mechanism to use LOGIN, PLAIN, CRAM-MD5 or DIGEST-MD5

Symptom: Vulnerability scan gets hit on port 5222 for XMPP Cleartext Authentication Conditions: Running security scan against Finesse. Conditions: Device configured with default configuration.

As discussed with Smart IT CE, as of now there is no mechanism to make this change.

A successful exploit could allow an attacker to access the system as another user. Step 2: Disable cleartext connections In Gajim for instance, the user would be informed that the authentication is going to happen without encryption, and asked for a confirmation.

In XMPP server one or more authentication that allows credentials to be sent in clear text.

View Bug Details in Bug Search Tool Why Is Login Required?