CVE-2016-0756

MEDIUM

prosody < 0.9.10 - Remote Domain Spoofing via Dialback Key Generation

Title source: llm

Description

The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.

References (8)

Core 8

Core References

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176796.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/82241

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176914.html

Issue Tracking x_refsource_confirm

https://prosody.im/issues/issue/596

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/01/27/10

Patch, Vendor Advisory x_refsource_confirm

http://blog.prosody.im/prosody-0-9-10-released/

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3463

Vendor Advisory x_refsource_confirm

https://prosody.im/security/advisory_20160127/

Scores

CVSS v3 5.3

EPSS 0.0205

EPSS Percentile 79.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE

CWE-20

Status published

Products (1)

prosody/prosody < 0.9.9

Published Jan 29, 2016

Tracked Since Feb 18, 2026