jabberd2 authentication bypass vulnerability
Original title: USN-8984-1: jabberd2 vulnerability
jabberd2 allows SASL ANONYMOUS authentication even when disabled in configuration.
It was discovered that jabberd2 allowed SASL ANONYMOUS authentication even when it was not enabled in the configuration. A remote attacker could possibly use this issue to bypass authentication. Ubuntu Security Notice USN-8984-1.
Unconfirmed: Exact affected versions and patch details not specified in the notice
- SASL ANONYMOUS enabled by default
- Authentication bypass possible
- Remote attacker can impersonate users
Impact: authentication bypass
| Product | Affected |
|---|---|
| jabberd2 | — |
- 1.Upgrade to patched version
From the original article
It was discovered that jabberd2 allowed SASL ANONYMOUS authentication even when it was not enabled in the configuration. A remote attacker could possibly use this issue to bypass authentication.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.