CVE-2016-9928
📋 TL;DR
CVE-2016-9928 is a roster push vulnerability in MCabber XMPP client that allows attackers to manipulate contact rosters. Remote attackers can add themselves to victims' contact lists, potentially intercepting communications or gaining unauthorized access to group chats and associated privileges. This affects MCabber users running versions before 1.0.4.
💻 Affected Systems
- MCabber
📦 What is this software?
Mcabber by Mcabber
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, interception of all communications, unauthorized access to private group chats, and privilege escalation within XMPP networks.
Likely Case
Attackers add themselves to victims' contact lists, enabling message interception, social engineering attacks, and unauthorized access to group conversations.
If Mitigated
Limited impact with proper network segmentation, TLS encryption, and roster validation, though some information leakage may still occur.
🎯 Exploit Status
Exploitation requires sending crafted XMPP packets, which can be done by anyone with network access to the XMPP traffic. Public exploit details are available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.4 and later
Vendor Advisory: https://bitbucket.org/McKael/mcabber-crew/commits/6e1ead98930d7dd0a520ad17c720ae4908429033/raw
Restart Required: Yes
Instructions:
1. Download MCabber 1.0.4 or later from official sources. 2. Compile and install following standard procedures. 3. Restart MCabber client. 4. Verify version with 'mcabber --version'.
🔧 Temporary Workarounds
Disable roster auto-accept
linuxConfigure MCabber to require manual approval for roster additions
Edit ~/.mcabber/mcabberrc and add: set roster_auto_accept = 0
Use TLS encryption
linuxEnforce TLS encryption for all XMPP connections to prevent packet interception
Edit ~/.mcabber/mcabberrc and ensure: set ssl = 1
set ssl_verify = 1
🧯 If You Can't Patch
- Isolate XMPP traffic using network segmentation and firewalls
- Monitor for unusual roster changes and implement strict roster management policies
🔍 How to Verify
Check if Vulnerable:
Run 'mcabber --version' and check if version is below 1.0.4Check Version:
mcabber --version | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+'Verify Fix Applied:
Run 'mcabber --version' and confirm version is 1.0.4 or higher📡 Detection & Monitoring
Log Indicators:
- Unexpected roster push notifications
- Unauthorized contact additions in roster logs
- XMPP roster modification events from unknown sources
Network Indicators:
- Crafted XMPP roster push packets
- Unusual XMPP traffic patterns during roster updates
- XMPP packets with manipulated JID attributes
SIEM Query:
source="xmpp" AND (event="roster_push" OR event="contact_added") AND NOT user IN allowed_users🔗 References
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00130.html
- http://www.openwall.com/lists/oss-security/2016/12/11/2
- http://www.openwall.com/lists/oss-security/2017/02/09/29
- http://www.securityfocus.com/bid/94862
- https://bitbucket.org/McKael/mcabber-crew/commits/6e1ead98930d7dd0a520ad17c720ae4908429033/raw
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845258
- https://bugzilla.redhat.com/show_bug.cgi?id=1403790
- https://gultsch.de/gajim_roster_push_and_message_interception.html
- https://lists.debian.org/debian-lts-announce/2020/06/msg00031.html
- https://usn.ubuntu.com/4506-1/
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00130.html
- http://www.openwall.com/lists/oss-security/2016/12/11/2
- http://www.openwall.com/lists/oss-security/2017/02/09/29
- http://www.securityfocus.com/bid/94862
- https://bitbucket.org/McKael/mcabber-crew/commits/6e1ead98930d7dd0a520ad17c720ae4908429033/raw
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845258
- https://bugzilla.redhat.com/show_bug.cgi?id=1403790
- https://gultsch.de/gajim_roster_push_and_message_interception.html
- https://lists.debian.org/debian-lts-announce/2020/06/msg00031.html
- https://usn.ubuntu.com/4506-1/
