Description
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or overwriting stack memory in NDEBUG builds.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
strophe libstrophe
Default version status: unaffected
0 to ≤ 0.14.0affected
References
- https://hackmd.io/@haindpwn/libstrophe-scram-salt-stack-overflow ↗
- https://github.com/strophe/libstrophe/blob/0.14.0/src/scram.c ↗
- https://github.com/strophe/libstrophe/blob/0.14.0/src/sasl.c ↗
- https://www.vulncheck.com/advisories/libstrophe-through-0.14.0-stack-based-buffer-overflow-via-scram-salt-in-scram-hi ↗