Skip to content
Fencer Vulns
medium 5.0

CVE-2006-1329 json

The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service ("c2s segfault") by sendin…

published 2006-03-21 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1333

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service ("c2s segfault") by sending a "response stanza before an auth stanza".

Patch / fix

  • jabberd2 Debian 14, Debian 13, Debian 12 2.0s11-1

debian advisories DEBIAN-CVE-2006-1329

  • jabberd network satellite 4.2, network proxy 4.2 2.0s10-3.37.rhn
  • jabberd network satellite 5.0, network satellite 4.2, network proxy 5.0 +1 more 2.0s10-3.38.rhn
  • tomcat5 network satellite 5.0, network satellite 4.2 5.0.30-0jpp_10rh
  • jfreechart network satellite 5.0, network satellite 4.2 0.9.20-3.rhn
  • rhn-apache network satellite 4.2, network proxy 4.2 1.3.27-36.rhn.rhel3
  • rhn-apache network satellite 5.0, network satellite 4.2, network proxy 5.0 +1 more 1.3.27-36.rhn.rhel4
  • rhn-modssl network satellite 4.2 2.8.12-8.rhn.10.rhel3
  • rhn-modssl network satellite 5.0, network satellite 4.2 2.8.12-8.rhn.10.rhel4

red hat advisories RHSA-2008:0524RHSA-2008:0523RHSA-2008:0263RHSA-2008:0261

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2006-1329 updated

jabberd SASL DoS

  • Red Hat Satellite 5.0 (RHEL v.4 AS) jabberd 2.0s10-3.38.rhn, jfreechart 0.9.20-3.rhn, tomcat5 5.0.30-0jpp_10rh, perl-Crypt-CBC 2.24-1.el4, rhn-modperl 1.29-16.rhel4, openmotif21 2.1.30-11.RHEL4.6, +4 more
    fixed: vendor fix RHSA-2008:0261
  • Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS) jabberd 2.0s10-3.37.rhn, rhn-modperl 1.29-16.rhel3, rhn-apache 1.3.27-36.rhn.rhel3 Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS) jabberd 2.0s10-3.38.rhn, rhn-modperl 1.29-16.rhel4, rhn-apache 1.3.27-36.rhn.rhel4
    fixed: vendor fix RHSA-2008:0523
  • Red Hat Satellite Proxy v 5.0 (RHEL v.4 AS) jabberd 2.0s10-3.38.rhn, rhn-modperl 1.29-16.rhel4, rhn-apache 1.3.27-36.rhn.rhel4
    fixed: vendor fix RHSA-2008:0263
  • Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd 2.0s10-3.37.rhn, jfreechart 0.9.20-3.rhn, tomcat5 5.0.30-0jpp_10rh, perl-Crypt-CBC 2.24-1.el3, rhn-modperl 1.29-16.rhel3, openmotif21 2.1.30-9.RHEL3.8, +4 more Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd 2.0s10-3.38.rhn, jfreechart 0.9.20-3.rhn, tomcat5 5.0.30-0jpp_10rh, perl-Crypt-CBC 2.24-1.el4, rhn-modperl 1.29-16.rhel4, openmotif21 2.1.30-11.RHEL4.6, +4 more
    fixed: vendor fix RHSA-2008:0524

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.89% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.