CVE - CVE-2012-3525

CVE-ID
CVE-2012-3525	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:50124 URL:http://secunia.com/advisories/50124 MISC:50859 URL:http://secunia.com/advisories/50859 MISC:55167 URL:http://www.securityfocus.com/bid/55167 MISC:APPLE-SA-2013-03-14-1 URL:http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html MISC:RHSA-2012:1538 URL:http://rhn.redhat.com/errata/RHSA-2012-1538.html MISC:RHSA-2012:1539 URL:http://rhn.redhat.com/errata/RHSA-2012-1539.html MISC:[jabberd2] 20120821 Fwd: [Security] Vulnerability in XMPP Server Dialback Implementations URL:http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01903.html MISC:[oss-security] 20120822 CVE Request -- jabberd2: Prone to unsolicited XMPP Dialback attacks URL:http://www.openwall.com/lists/oss-security/2012/08/22/5 MISC:[oss-security] 20120822 Re: CVE Request -- jabberd2: Prone to unsolicited XMPP Dialback attacks URL:http://www.openwall.com/lists/oss-security/2012/08/22/6 MISC:http://xmpp.org/resources/security-notices/server-dialback/ URL:http://xmpp.org/resources/security-notices/server-dialback/ MISC:https://bugzilla.redhat.com/show_bug.cgi?id=850872 URL:https://bugzilla.redhat.com/show_bug.cgi?id=850872 MISC:https://github.com/Jabberd2/jabberd2/commit/aabcffae560d5fd00cd1d2ffce5d760353cf0a4d URL:https://github.com/Jabberd2/jabberd2/commit/aabcffae560d5fd00cd1d2ffce5d760353cf0a4d
Assigning CNA
Red Hat, Inc.
Date Record Created
20120614	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20120614)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)

Use of the CVE® List and the associated references from this website are subject to the terms of use. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2024, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation.