Bug 850872 (CVE-2012-3525) - CVE-2012-3525 jabberd: Prone to unsolicited XMPP Dialback attacks
Summary: CVE-2012-3525 jabberd: Prone to unsolicited XMPP Dialback attacks
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-3525
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact: Dimitar Yordanov
URL:
Whiteboard:
Depends On: 880130 882195
Blocks: 850876
TreeView+ depends on / blocked
 
Reported: 2012-08-22 15:21 UTC by Jan Lieskovsky
Modified: 2021-02-23 14:02 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-09-20 02:02:29 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1538 0 normal SHIPPED_LIVE Low: Red Hat Network Satellite server jabberd security update 2012-12-04 23:58:34 UTC
Red Hat Product Errata RHSA-2012:1539 0 normal SHIPPED_LIVE Low: Red Hat Network Proxy server jabberd security update 2012-12-04 23:58:27 UTC

Description Jan Lieskovsky 2012-08-22 15:21:02 UTC 
A security flaw was found in the XMPP Dialback protocol implementation of jabberd2, OpenSource server implementation of the Jabber protocols (Verify Response and Authorization Response were not checked within XMPP protocol server to server session). A rogue XMPP server could use this flaw to spoof one or more domains, when communicating with vulnerable server implementation, possibly leading into XMPP's Server Dialback protections bypass.

References:
[1] http://xmpp.org/resources/security-notices/server-dialback/

Upstream patch:
[2] https://github.com/Jabberd2/jabberd2/commit/aabcffae560d5fd00cd1d2ffce5d760353cf0a4d
Comment 1 Jan Lieskovsky 2012-08-22 15:24:16 UTC 
This issue has been corrected in the (upcoming) Fedora and Fedora EPEL jabberd packages:

Rawhide:       jabberd-2.2.16-5.fc18
Fedora-17:     jabberd-2.2.14-4.fc17
Fedora-16:     jabberd-2.2.14-4.fc16
Fedora EPEL 6: jabberd-2.2.14-4.el6
Fedora EPEL 5: jabberd-2.2.11-4.el5
Comment 2 Jan Lieskovsky 2012-08-22 15:25:10 UTC 
This issue affects the versions of the jabberd package, as shipped with Red Hat Network Satellite Server 5.4 and with Red Hat Network Proxy Server 5.4.
Comment 3 Jan Lieskovsky 2012-08-22 15:30:16 UTC 
CVE request:
http://www.openwall.com/lists/oss-security/2012/08/22/5
Comment 4 Jan Lieskovsky 2012-08-23 10:53:09 UTC 
The CVE identifier of CVE-2012-3525 has been assigned to this issue:
http://www.openwall.com/lists/oss-security/2012/08/22/6
Comment 5 Fedora Update System 2012-09-03 00:48:14 UTC 
jabberd-2.2.14-4.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2012-09-03 00:48:30 UTC 
jabberd-2.2.14-4.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2012-09-09 18:32:13 UTC 
jabberd-2.2.11-4.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2012-09-09 18:34:59 UTC 
jabberd-2.2.14-4.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2012-09-17 23:29:10 UTC 
jabberd-2.2.17-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Stefan Cornelius 2012-11-01 09:03:46 UTC 
Statement:

The Red Hat Security Response Team has rated this issue as having low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Comment 29 errata-xmlrpc 2012-12-04 19:14:49 UTC 
This issue has been addressed in following products:

  Red Hat Network Proxy v 5.5

Via RHSA-2012:1539 https://rhn.redhat.com/errata/RHSA-2012-1539.html
Comment 30 errata-xmlrpc 2012-12-04 19:15:26 UTC 
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.5

Via RHSA-2012:1538 https://rhn.redhat.com/errata/RHSA-2012-1538.html
Note You need to log in before you can comment on or make changes to this bug.