Bug 851913 - (CVE-2012-4670) CVE-2012-4670 tigase: Prone to unsolicited XMPP Dialback attacks
CVE-2012-4670 tigase: Prone to unsolicited XMPP Dialback attacks
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 851914
  Show dependency treegraph
Reported: 2012-08-26 23:35 EDT by Kurt Seifried
Modified: 2015-08-22 11:32 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2015-08-22 11:32:18 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Kurt Seifried 2012-08-26 23:35:54 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4670 to
the following vulnerability:

Name: CVE-2012-4670
Reference: MISC:http://xmpp.org/resources/security-notices/server-dialback/ [Open URL]
Reference: CONFIRM:http://www.tigase.org/content/finally-version-510-final-available [Open URL]
Reference: CONFIRM:https://projects.tigase.org/projects/tigase-server/repository/revisions/2953/diff [Open URL]

Tigase XMPP Server before 5.1.0 does not verify that a request was
made for an XMPP Server Dialback response, which allows remote XMPP
servers to spoof domains via a (1) Verify Response or (2)
Authorization Response.
Comment 1 Kurt Seifried 2012-08-26 23:37:17 EDT
Created tigase-server tracking bugs for this issue

Affects: epel-all [bug 851914]

Note You need to log in before you can comment on or make changes to this bug.