CVE-2012-3525

jabberd2 <= 2.2.16 - Domain Spoofing via Unverified XMPP Server Dialback Response

Title source: llm
STIX 2.1

Description

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

References (12)

Core 12
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-1538.html
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/08/22/5
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/08/22/6
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/55167
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/50124
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=850872
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-1539.html
Mailing List mailing-list x_refsource_mlist
http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01903.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/50859

Scores

EPSS 0.0173
EPSS Percentile 74.9%

Details

CWE
CWE-20
Status published
Products (43)
jabber2/jabberd2 2.1.19
jabberd2/jabberd2 2.1
jabberd2/jabberd2 2.1.1
jabberd2/jabberd2 2.1.2
jabberd2/jabberd2 2.1.3
jabberd2/jabberd2 2.1.4
jabberd2/jabberd2 2.1.5
jabberd2/jabberd2 2.1.6
jabberd2/jabberd2 2.1.7
jabberd2/jabberd2 2.1.8
... and 33 more
Published Aug 25, 2012
Tracked Since Feb 18, 2026