Secunia reports :

A vulnerability has been reported in Openfire, which can be exploited by malicious people to cause a Denial of Service.

The vulnerability is caused due to an unspecified error and can be exploited to cause a Denial of Service.

The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol.

According to its version, the installation of Openfire or Wildfire on the remote host suffers from a denial of service vulnerability that could bring the server down because it has no limit on a client session's send buffer and can not handle clients that fail to read messages.

远程主机正在运行 Openfire / Wildfire，这是一款支持 XMPP 协议的即时消息传递服务器。

根据其版本，远程主机上安装的 Openfire 或 Wildfire 受到一个拒绝服务漏洞的影响，该漏洞可导致服务器崩溃，这是因为其对客户端会话的发送缓冲区没有限制，且无法处理无法读取消息的客户端。

リモートホストは、XMPPプロトコルをサポートするインスタントメッセージングサーバーであるOpenfire/Wildfireを実行しています。

そのバージョンによると、リモートホストにインストールされているOpenfireまたはWildfireは、サービス拒否の脆弱性の影響を受けます。これは、クライアントセッションの送信バッファに制限がなく、メッセージの読み取りに失敗したクライアントを処理できないため、サーバーをダウンさせる可能性があります。

遠端主機正在執行 Openfire/Wildfire，這是一個支援 XMPP 通訊協定的即時訊息伺服器。

根據其版本來判斷，遠端主機上安裝的 Openfire 或 Wildfire 受到一個拒絕服務弱點影響，此弱點可造成伺服器當機，其原因在於它對用戶端工作階段的傳送緩衝區沒有限制，且無法處理未能讀取訊息的用戶端。

The remote host is affected by the vulnerability described in GLSA-200804-26 (Openfire: Denial of Service)

    Openfire's connection manager in the file ConnectionManagerImpl.java     cannot handle clients that fail to read messages, and has no limit on     their session's send buffer.
  Impact :

    Remote authenticated attackers could trigger large outgoing queues     without reading messages, causing a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Andreas Kurtz reports :

The jabber server Openfire (<= version 3.6.0a) contains several serious vulnerabilities. Depending on the particular runtime environment these issues can potentially even be used by an attacker to execute code on operating system level.

- Authentication bypass - This vulnerability provides an attacker full access to all functions in the admin webinterface without providing any user credentials. The Tomcat filter which is responsible for authentication could be completely circumvented.

- SQL injection - It is possible to pass SQL statements to the backend database through a SQL injection vulnerability. Depending on the particular runtime environment and database permissions it is even possible to write files to disk and execute code on operating system level.

- Multiple Cross-Site Scripting - Permits arbitrary insertion of HTML- and JavaScript code in login.jsp. An attacker could also manipulate a parameter to specify a destination to which a user will be forwarded to after successful authentication.

The remote host is running Openfire / Wildfire, an instant messaging server that supports the XMPP protocol.  According to its version, the installation of Openfire or Wildfire on the remote host suffers from an unspecified denial of service vulnerability that could bring the server down.

ID	名稱	產品	系列	已發布	已更新	嚴重性
32069	FreeBSD : openfire -- unspecified denial of service (b84a992a-12ab-11dd-bab7-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	2008/4/28	2021/1/6	medium
31855	Openfire < 3.5.0 ConnectionManagerImpl.java Queue Handling Remote DoS	Nessus	Denial of Service	2008/4/11	2018/11/15	high
31855	Openfire < 3.5.0 ConnectionManagerImpl.java 队列处理远程 DoS	Nessus	Denial of Service	2008/4/11	2018/11/15	high
31855	Openfire < 3.5.0 ConnectionManagerImpl.javaキュー処理のリモートDoS	Nessus	Denial of Service	2008/4/11	2018/11/15	high
31855	Openfire < 3.5.0 ConnectionManagerImpl.java 佇列處理遠端 DoS	Nessus	Denial of Service	2008/4/11	2018/11/15	high
32046	GLSA-200804-26 : Openfire: Denial of Service	Nessus	Gentoo Local Security Checks	2008/4/25	2021/1/6	medium
34839	FreeBSD : openfire -- multiple vulnerabilities (937adf01-b64a-11dd-a55e-00163e000016)	Nessus	FreeBSD Local Security Checks	2008/11/21	2021/1/6	high
4463	Openfire < 3.5.0 Queue Handling Remote DoS	Nessus Network Monitor	CGI	2008/4/14	2019/3/6	low

偵測

搜尋 Plugin

medium

high

high

high

high

medium

high

low