CVE-2016-0756 The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network....
MediumCVSS 5.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/prosody(Debian:12) | < 0.9.10-1 | 0.9.10-1 |
| debian/prosody(Debian:13) | < 0.9.10-1 | 0.9.10-1 |
| debian/prosody(Debian:14) | < 0.9.10-1 | 0.9.10-1 |
| prosody | <= 0.9.9 | No fix listed |
References
- Debian Security Tracker CVE-2016-0756 vendor-advisory
- blog.prosody.im patch vendor-advisory
- FEDORA-2016-e2c5111eda vendor-advisory
- FEDORA-2016-5a5c85c5a8 vendor-advisory
- DSA-3463 vendor-advisory
- [oss-security] 20160127 CVE-2016-0756: Prosody XMPP server: insecure dialback key generation/validation algorithm mailing-list
- 82241 vdb-entry
- prosody.im
- prosody.im vendor-advisory