CVE-2014-0364

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.

El componente ParseRoster en la API Ignite Realtime Smack XMPP anterior a 4.0.0-rc1 no verifica el atributo from de la cadena roster-query IQ, lo que permite a atacantes remotos falsificar respuestas IQ a través de un atributo manipulado.