Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Miranda IM silent TLS failure
From: Jan Schejbal <jan.mailinglisten () googlemail com>
Date: Wed, 17 Mar 2010 01:31:29 +0100

Under certain conditions, Miranda ignores the "Use TLS" setting in 
Jabber accounts and uses an unencrypted connection.

Affected: Miranda IM (instant messenger), at least versions 0.8.16, 
0.9.0 alpha build #6 Unicode and SVN rev. 11383

If the following conditions are met:
  - "Use TLS" is enabled in the jabber account settings (Network - 
Jabber - Account),

  - "Validate SSL certificates" is enabled in the Network settings

  - "Disable SASL authentication" is enabled in the advanced jabber 
settings (Network - Jabber - Advanced, Miscellaneous - Server options)

Miranda will silently connect to the server without using TLS, sending 
all data in plain.

Impact: This issue allows eavesdropping and impersonation attacks on the 
connection to the XMPP/Jabber server, even if "Use TLS" is enabled and 
the user assumes the connection to be secure.

Uncheck "Disable SASL authentication" and restart Miranda.
Make sure the server certificate is trusted (via the Windows certificate 
store), or your connections will fail.

The bug was reported to the authors via their bug tracker.

I disclose the issue to the public without waiting for a patch because

  a) no harm is expected from public knowledge of this issue, even as no 
patch exists

  b) an easy workaround (fixing the settings) exists

It seems that this issue was already reported by another user in 2009:

According to that, the "Disable SASL" setting suppresses TLS and no 
warning is given to the user.

Ensure that if "Use TLS" is checked, failure to establish a TLS-secured 
connection is a fatal error. No data should be transferred and the user 
should be warned about this.

*Additionally*, make "Use TLS" and "Disable SASL" mutually exclusive and 
change the misleading name of the "Disable SASL" setting.

written by: Jan Schejbal

Thanks to Protogenes and Nico Haase for testing and confirming the issue.

Kind regards,
Jan Schejbal

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Miranda IM silent TLS failure Jan Schejbal (Mar 17)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]