Description
The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service ("c2s segfault") by sending a "response stanza before an auth stanza".
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jabberd2 | 2.0s11-1 | — |
| Debian 13 | jabberd2 | 2.0s11-1 | — |
| Debian 12 | jabberd2 | 2.0s11-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | openmotif21 | 2.1.30-11.RHEL4.6 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | perl-Crypt-CBC | 2.24-1.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modssl | 2.8.12-8.rhn.10.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0261 |
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
| Red Hat Network Proxy 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0263 |
| Red Hat Network Proxy 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0263 |
| Red Hat Network Proxy 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0263 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Proxy 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0523 |
Advisories 4
- RHSA-2008:0523 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0263 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- jabberd-sasl-dos(25334) vdb-entry
- ADV-2006-1009 vdb-entry
- 17155 vdb-entry
- APPLE-SA-2010-03-29-1 vendor-advisory
- http://support.apple.com/kb/HT4077
- 19281 third-party-advisory
- RHSA-2008:0261 vendor-advisory
- http://article.gmane.org/gmane.network.jabber.admin/27372