Bug 851913 (CVE-2012-4670) - CVE-2012-4670 tigase: Prone to unsolicited XMPP Dialback attacks
Summary: CVE-2012-4670 tigase: Prone to unsolicited XMPP Dialback attacks
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2012-4670
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 851914
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-08-27 03:35 UTC by Kurt Seifried
Modified: 2019-09-29 12:55 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-08-22 15:32:18 UTC
Embargoed:

Attachments (Terms of Use)

Description Kurt Seifried 2012-08-27 03:35:54 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4670 to
the following vulnerability:

Name: CVE-2012-4670
Reference: MISC:http://xmpp.org/resources/security-notices/server-dialback/ [Open URL]
Reference: CONFIRM:http://www.tigase.org/content/finally-version-510-final-available [Open URL]
Reference: CONFIRM:https://projects.tigase.org/projects/tigase-server/repository/revisions/2953/diff [Open URL]

Tigase XMPP Server before 5.1.0 does not verify that a request was
made for an XMPP Server Dialback response, which allows remote XMPP
servers to spoof domains via a (1) Verify Response or (2)
Authorization Response.
Comment 1 Kurt Seifried 2012-08-27 03:37:17 UTC 
Created tigase-server tracking bugs for this issue

Affects: epel-all [bug 851914]
Note You need to log in before you can comment on or make changes to this bug.