Read the docs
TI-2006-01283 Aliases CVE-2006-1329GHSA-5h3v-3vr7-9g6j

The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to…

Priority LOW 28Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service ("c2s segfault") by sending a "response stanza before an auth stanza".

Why it matters now

EPSS 0.02893 86th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:jabberstudio:jabberd:*:*:*:*:*:*:*:*up to 2.0_s10VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_a1:*:*:*:*:*:*:*2.0_a1VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_a2:*:*:*:*:*:*:*2.0_a2VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_a3:*:*:*:*:*:*:*2.0_a3VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_a4:*:*:*:*:*:*:*2.0_a4VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_a5:*:*:*:*:*:*:*2.0_a5VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_a6:*:*:*:*:*:*:*2.0_a6VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_b1:*:*:*:*:*:*:*2.0_b1VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_b2:*:*:*:*:*:*:*2.0_b2VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_b3:*:*:*:*:*:*:*2.0_b3VulnerableJabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:*:*:*:*:*:*:*:* Versions up to 2.0_s10 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_a1:*:*:*:*:*:*:* Versions 2.0_a1 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_a2:*:*:*:*:*:*:* Versions 2.0_a2 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_a3:*:*:*:*:*:*:* Versions 2.0_a3 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_a4:*:*:*:*:*:*:* Versions 2.0_a4 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_a5:*:*:*:*:*:*:* Versions 2.0_a5 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_a6:*:*:*:*:*:*:* Versions 2.0_a6 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_b1:*:*:*:*:*:*:* Versions 2.0_b1 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_b2:*:*:*:*:*:*:* Versions 2.0_b2 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_b3:*:*:*:*:*:*:* Versions 2.0_b3 Vulnerable ·Jabberstudio
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jabberstudio:jabberd:2.0_rc1:*:*:*:*:*:*:*2.0_rc1VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_rc2:*:*:*:*:*:*:*2.0_rc2VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_s1:*:*:*:*:*:*:*2.0_s1VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_s2:*:*:*:*:*:*:*2.0_s2VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_s3:*:*:*:*:*:*:*2.0_s3VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_s4:*:*:*:*:*:*:*2.0_s4VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_s5:*:*:*:*:*:*:*2.0_s5VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_s6:*:*:*:*:*:*:*2.0_s6VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_s7:*:*:*:*:*:*:*2.0_s7VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_s8:*:*:*:*:*:*:*2.0_s8VulnerableJabberstudio
cpe:2.3:a:jabberstudio:jabberd:2.0_s9:*:*:*:*:*:*:*2.0_s9VulnerableJabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_rc1:*:*:*:*:*:*:* Versions 2.0_rc1 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_rc2:*:*:*:*:*:*:* Versions 2.0_rc2 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_s1:*:*:*:*:*:*:* Versions 2.0_s1 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_s2:*:*:*:*:*:*:* Versions 2.0_s2 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_s3:*:*:*:*:*:*:* Versions 2.0_s3 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_s4:*:*:*:*:*:*:* Versions 2.0_s4 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_s5:*:*:*:*:*:*:* Versions 2.0_s5 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_s6:*:*:*:*:*:*:* Versions 2.0_s6 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_s7:*:*:*:*:*:*:* Versions 2.0_s7 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_s8:*:*:*:*:*:*:* Versions 2.0_s8 Vulnerable ·Jabberstudio
  • cpe:2.3:a:jabberstudio:jabberd:2.0_s9:*:*:*:*:*:*:* Versions 2.0_s9 Vulnerable ·Jabberstudio

Remediation

Red Hat 4 advisories

  • RHSA-2008:0524 Released 2008-06-30 · Red Hat rating Low
    Red Hat Network Satellite Server security update
    • Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el3.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el3.i386 +8
    • Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
  • RHSA-2008:0523 Released 2008-06-30 · Red Hat rating Low
    Red Hat Network Proxy Server security update
    • Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, rhn-apache-1.3.27-36.rhn.rhel3.i386, rhn-modperl-1.29-16.rhel3.i386
    • Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, rhn-apache-1.3.27-36.rhn.rhel4.i386, rhn-modperl-1.29-16.rhel4.i386
  • RHSA-2008:0263 Released 2008-05-20 · Red Hat rating Low
    Red Hat Network Proxy Server security update
    • Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, rhn-apache-1.3.27-36.rhn.rhel4.i386, rhn-modperl-1.29-16.rhel4.i386
Show 1 more Red Hat advisories
  • RHSA-2008:0261 Released 2008-05-20 · Red Hat rating Moderate
    Red Hat Network Satellite Server security update
    • Red Hat Satellite 5.0 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 5.0 (RHEL v.4 AS)Fixed RHSA-2008:0261
Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)Fixed RHSA-2008:0523
Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)Fixed RHSA-2008:0523
Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS)Fixed RHSA-2008:0263
Red Hat Satellite v 4.2 (RHEL v.3 AS)Fixed RHSA-2008:0524
Red Hat Satellite v 4.2 (RHEL v.4 AS)Fixed RHSA-2008:0524

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-1329
  2. 2026-10-03 Alias added: GHSA-5h3v-3vr7-9g6j

References

Patch 1

Advisory 3

Other 1

  • TI-2004-01255 The expat XML parser code, as used in the open source Jabber (jabberd) 1.4.3 and earlier… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences