Ubuntu 16.04 jabberd2 SASL Authentication Bypass: USN-8984-1 Remediation and Detection Guide

---
title: jabberd2 SASL Authentication Anomaly - Success Without Prior Failure Pattern
id: 3f8a1c42-9b7e-4d21-a6f5-2c8e9d4b7a31
status: experimental
description: Detects SASL authentication success events on jabberd2 c2s component from unusual or external source addresses, potentially indicating exploitation of the SASL authentication bypass addressed in USN-8984-1. Tune the internal ranges to your environment.
references:
  - https://linuxsecurity.com/advisories/ubuntu/ubuntu-8984-1-jabberd2
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1190
logsource:
  product: linux
  service: jabberd2
detection:
  selection:
    - 'sasl' 
    - 'succeeded'
  selection_success:
    - 'auth' 
    - 'sasl'
  condition: selection and selection_success
falsepositives:
  - Legitimate XMPP client logins - baseline expected source ranges and filter known client subnets
level: medium
---
title: Network Connection to XMPP Services on Legacy Ubuntu Hosts
id: 7d2e9f15-4a6c-48b3-91e2-5f7c3a8d9e42
status: experimental
description: Detects inbound network connections to jabberd2 XMPP service ports (5222/5269) from external sources. Useful for surfacing exposure of jabberd2 instances pending USN-8984-1 patching.
references:
  - https://linuxsecurity.com/advisories/ubuntu/ubuntu-8984-1-jabberd2
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort:
      - 5222
      - 5269
      - 5223
    Initiated: 'false'
  condition: selection
falsepositives:
  - Intended XMPP federation and client traffic - restrict alerting to hosts not designated as XMPP servers or alert only on connections to hosts running jabberd2 version below the patched release
level: low
---
title: jabberd2 Process Spawning Unexpected Child Processes
id: 9c4b7e28-6d1f-43a5-b8e4-3a9d2f6c8b53
status: experimental
description: Detects jabberd2 components (sm, c2s, s2s, router) spawning shell or interpreter child processes, which may indicate post-exploitation activity following compromise of the service via the SASL bypass or other flaws.
references:
  - https://linuxsecurity.com/advisories/ubuntu/ubuntu-8984-1-jabberd2
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/sm'
      - '/c2s'
      - '/s2s'
      - '/router'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Rare - jabberd2 components do not legitimately spawn shells; investigate any hit
level: high

// Hunt for jabberd2 SASL auth anomalies and suspicious child processes on Ubuntu hosts
// Scope: Syslog (AMA/legacy agent) and DeviceProcessEvents for enrolled Linux endpoints

let lookback = 14d;
let xmpp_ports = dynamic([5222, 5269, 5223]);

// Part 1: SASL authentication events from jabberd2 in syslog
Syslog
| where TimeGenerated > ago(lookback)
| where ProcessName has_any ("jabberd", "c2s", "sm", "s2s", "router")
| where SyslogMessage has_any ("sasl", "auth")
| extend AuthOutcome = iff(SyslogMessage has_any ("success", "succeeded", "authenticated"), "Success",
                     iff(SyslogMessage has_any ("fail", "denied", "invalid"), "Failure", "Other"))
| summarize SuccessCount = countif(AuthOutcome == "Success"),
            FailureCount = countif(AuthOutcome == "Failure"),
            SampleMessages = make_list(SyslogMessage, 5)
  by Computer, ProcessName, bin(TimeGenerated, 1h)
| where SuccessCount > 0 and FailureCount == 0  // success-only pattern: atypical for real user bases, possible scripted bypass
| project TimeGenerated, Computer, ProcessName, SuccessCount, FailureCount, SampleMessages;

// Part 2: Inbound connections to XMPP service ports (via CommonSecurityLog from firewall/NSG)
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DestinationPort in (xmpp_ports)
| where DeviceAction !in ("deny", "drop", "blocked")
| summarize ConnectionCount = count(), SourceIPs = make_set(SourceIP, 20)
  by DestinationIP, DestinationPort, bin(TimeGenerated, 1d)
| where ConnectionCount > 100  // threshold tuned to catch scanning bursts; adjust per baseline
| project TimeGenerated, DestinationIP, DestinationPort, ConnectionCount, SourceIPs;

// Part 3: jabberd2-spawned shells on Defender for Endpoint enrolled Linux hosts
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName has_any ("sm", "c2s", "s2s", "router")
| where FileName has_any ("bash", "sh", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

-- Hunt: jabberd2 USN-8984-1 exposure assessment and compromise indicators
-- Targets: Ubuntu 16.04 hosts running jabberd2

// Installed jabberd2 package version
LET pkg_version = SELECT * FROM execve(
    argv=['dpkg-query', '-W', '-f=${Version}', 'jabberd2']
)

// Listening sockets on XMPP service ports
LET xmpp_listeners = SELECT Laddr, Raddr, State, Pid, Name
FROM netstat()
WHERE Laddr =~ ':5222|:5269|:5223'
  AND State = 'LISTEN'

// Processes parented to jabberd2 components (post-exploitation signal)
LET jabber_children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '^(sm|c2s|s2s|router)$'
)
  AND Name =~ '(bash|sh|dash|python|perl|curl|wget|nc|ncat)'

// Recent SASL-related syslog lines for the service
LET auth_logs = SELECT * FROM parse_file(
    filename='/var/log/syslog',
    accessor='file'
)

SELECT 'package_version' AS CheckType, * FROM pkg_version
UNION ALL
SELECT 'xmpp_listener' AS CheckType, * FROM xmpp_listeners
UNION ALL
SELECT 'jabber_child_process' AS CheckType, * FROM jabber_children

#!/usr/bin/env bash
# USN-8984-1 jabberd2 SASL auth bypass - patch and verification script
# Target: Ubuntu 16.04 LTS (Xenial) with Ubuntu Pro / ESM entitlement
# Run as root or via sudo. Exit codes: 0=remediated, 1=action required, 2=not applicable

set -euo pipefail

echo "=== USN-8984-1 jabberd2 Remediation Check ==="

# 1. Confirm this host actually has jabberd2 installed
if ! dpkg-query -W -f='${Status}' jabberd2 2>/dev/null | grep -q "install ok installed"; then
    echo "[SKIP] jabberd2 is not installed on this host."
    exit 2
fi

echo "[INFO] jabberd2 installed: $(dpkg-query -W -f='${Version}' jabberd2)"

# 2. Confirm ESM entitlement - Xenial only receives this fix via Ubuntu Pro
if ! command -v pro >/dev/null 2>&1; then
    echo "[FAIL] ubuntu-advantage-tools / 'pro' client not present."
    echo "       Ubuntu 16.04 is ESM-only. Attach a token: pro attach <TOKEN>"
    exit 1
fi

if ! pro status 2>/dev/null | grep -qE "esm-infra.*(enabled|entitled)"; then
    echo "[FAIL] ESM-Infra not enabled. This fix is ONLY available via ESM on 16.04."
    echo "       Run: pro attach <TOKEN> && pro enable esm-infra"
    exit 1
fi

echo "[OK] ESM entitlement active."

# 3. Capture pre-patch version, apply updates
PRE_VERSION=$(dpkg-query -W -f='${Version}' jabberd2)
echo "[INFO] Pre-patch version: ${PRE_VERSION}"

apt-get update -qq
apt-get install --only-upgrade -y jabberd2

POST_VERSION=$(dpkg-query -W -f='${Version}' jabberd2)
echo "[INFO] Post-patch version: ${POST_VERSION}"

# 4. Restart the service to load patched binaries
if systemctl is-active --quiet jabberd2 2>/dev/null; then
    systemctl restart jabberd2
    echo "[OK] jabberd2 service restarted."
elif service jabberd2 status >/dev/null 2>&1; then
    service jabberd2 restart
    echo "[OK] jabberd2 service restarted (sysvinit)."
else
    echo "[WARN] jabberd2 service not detected via systemctl/service - restart manually."
fi

# 5. Verify version changed and service is listening
if [ "${PRE_VERSION}" = "${POST_VERSION}" ]; then
    echo "[FAIL] Package version unchanged after update. Check apt sources/ESM repo access."
    exit 1
fi

sleep 3
if ss -tlnp 2>/dev/null | grep -qE ':(5222|5269)'; then
    echo "[OK] XMPP listener confirmed on 5222/5269 after restart."
fi

echo "[PASS] jabberd2 patched ${PRE_VERSION} -> ${POST_VERSION}. Verify against USN-8984-1 fixed version in the Canonical advisory."
exit 0