Remotely exploitable DoS from XMPP client to ejabberd server
via flood of "client2server" messages (causing the message queue on
the server to get overloaded, leading to server crash) has been found.
Track of the incident:
Upstream patches against v2.1:
This issue affects the latest versions of ejabberd package, as shipped
with Fedora 11 (ejabberd-2.1.1-1.fc11) and 12 (ejabberd-2.1.1-1.fc12).
This issue affects the latest version of ejabberd package, as shipped
with EPEL-5 project (ejabberd-2.0.5-8.el5).
ejabberd-2.1.2-2.fc12 has been submitted as an update for Fedora 12.
ejabberd-2.1.2-2.fc11 has been submitted as an update for Fedora 11.
This is CVE-2010-0305.
ejabberd-2.1.2-2.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
ejabberd-2.1.2-2.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
*** Bug 559890 has been marked as a duplicate of this bug. ***
*** Bug 559909 has been marked as a duplicate of this bug. ***