Miranda IM 'Use TLS' Configuration Option Security Bypass Vulnerability

Bugtraq ID:	38807
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Mar 17 2010 12:00AM
Updated:	Mar 17 2010 12:00AM
Credit:	Jan Schejbal
Vulnerable:	Miranda Miranda IM 0.8.16 Miranda Miranda IM 0.7.1 Miranda Miranda IM 0.7
Not Vulnerable:

Miranda IM 'Use TLS' Configuration Option Security Bypass Vulnerability

Attackers can exploit this issue with readily available tools.

Miranda IM 'Use TLS' Configuration Option Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Miranda IM 'Use TLS' Configuration Option Security Bypass Vulnerability

References:

• Issue 152: unencrypted connection to Jabber server although TLS is set ([email protected])
  
• Miranda IM Homepage (Miranda)
  
• Miranda IM silent TLS failure (Jan Schejbal )