Reading · Daniel Gultsch · RSS Amplifier

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

CVE-2019-16235+: Missing or incorrect sender validations in Dino allow an attacker to spoof messages and inject or remove entries from the user’s roster. 
 Introduction 
 Dino is a Jabber/XMPP client written in Vala and GTK. On September 10th 2019, while chatting on a public channel, a number of vulnerabilities were discovered in Dino. The discovery was initially prompted by a user of the…

CVE-2019-16235+: Missing or incorrect sender validations in Dino allow an attacker to spoof messages and inject or remove entries from the user’s roster.

Introduction

Dino is a Jabber/XMPP client written in Vala and GTK. On September 10th 2019, while chatting on a public channel, a number of vulnerabilities were discovered in Dino. The discovery was initially prompted by a user of the name balu_der_bär who was deliberately sending fake Message Carbons to the channel. This quickly led to the diagnosis that Dino was not properly verifying the sender of a Message Carbon before parsing it (CVE-2019-16235). Message Carbons are only valid if they are coming from the user’s account. This vulnerability is an exact replica of the vulnerabilities already described in CVE-2017-5589+ that were discovered in February 2017 in multiple Jabber/XMPP clients.

Multiple Vulnerabilities found in Dino

Introduction

Comments