CVE-2016-9928

What it actually does

The vulnerability permits remote attackers to inject crafted XMPP roster push packets that are accepted without proper validation, enabling roster manipulation to intercept communications or add attacker-controlled entities with associated privileges.

Why it matters to the business

Attackers can silently join third-party contact lists or eavesdrop on messaging, resulting in privacy breaches, unauthorized access to conversations, and potential escalation to broader account or network compromise.

How an attack unfolds

An attacker crafts malicious XMPP roster push packets and transmits them to a vulnerable client; the client processes the packets without authentication checks, updating the roster to include the attacker or enabling message interception.

How to fix it

Upgrade MCabber to version 1.0.4 or later; for affected Horde GIT installations apply the fix from commit faf20b21798a6237f8f901c912d70448ab8201ba.

How to confirm the fix worked

Confirm MCabber version is 1.0.4 or newer; verify the specified Horde GIT commit is present in the codebase and test that roster push packets from untrusted sources are rejected.

Typical attack path

1. Identify a target running a vulnerable XMPP client
2. Craft and send malicious roster push packets over XMPP
3. Client accepts the packets and modifies the local roster
4. Attacker gains roster privileges or communication interception capability

How to detect it

Inspect XMPP client and server logs for unexpected roster push events or unauthorized roster modifications; correlate with timestamps of contact list changes originating from external sources.

• roster push
• crafted XMPP packets
• unauthorized roster addition

What your security team should do

• Immediately upgrade all MCabber instances to 1.0.4 or later
• Apply the referenced Horde GIT commit where the component is in use
• Review and harden XMPP roster handling policies
• Implement network monitoring for anomalous XMPP roster activity