CVE-2012-3525

EUVD-2012-3480
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
Affected Products (NVD)
VendorProductVersion
jabber2jabberd2
2.1.19
jabberd2jabberd2
𝑥
≤ 2.2.16
jabberd2jabberd2
2.1
jabberd2jabberd2
2.1.1
jabberd2jabberd2
2.1.2
jabberd2jabberd2
2.1.3
jabberd2jabberd2
2.1.4
jabberd2jabberd2
2.1.5
jabberd2jabberd2
2.1.6
jabberd2jabberd2
2.1.7
jabberd2jabberd2
2.1.8
jabberd2jabberd2
2.1.9
jabberd2jabberd2
2.1.10
jabberd2jabberd2
2.1.11
jabberd2jabberd2
2.1.12
jabberd2jabberd2
2.1.13
jabberd2jabberd2
2.1.14
jabberd2jabberd2
2.1.15
jabberd2jabberd2
2.1.16
jabberd2jabberd2
2.1.17
jabberd2jabberd2
2.1.18
jabberd2jabberd2
2.1.20
jabberd2jabberd2
2.1.21
jabberd2jabberd2
2.1.22
jabberd2jabberd2
2.1.23
jabberd2jabberd2
2.1.24
jabberd2jabberd2
2.2.0
jabberd2jabberd2
2.2.1
jabberd2jabberd2
2.2.2
jabberd2jabberd2
2.2.3
jabberd2jabberd2
2.2.4
jabberd2jabberd2
2.2.5
jabberd2jabberd2
2.2.6
jabberd2jabberd2
2.2.7
jabberd2jabberd2
2.2.7.1
jabberd2jabberd2
2.2.8
jabberd2jabberd2
2.2.9
jabberd2jabberd2
2.2.10
jabberd2jabberd2
2.2.11
jabberd2jabberd2
2.2.12
jabberd2jabberd2
2.2.13
jabberd2jabberd2
2.2.14
jabberd2jabberd2
2.2.15
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
jabberd2
bookworm
2.7.0-4
fixed
bullseye
2.7.0-2
fixed
sid
2.7.0-7
fixed
trixie
2.7.0-7
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jabberd2
hardy
Fixed 2.0s11-1ubuntu4.2
released
lucid
Fixed 2.2.8-2ubuntu4.0.10.04.2
released
natty
ignored
oneiric
Fixed 2.2.8-2ubuntu6.1
released
precise
Fixed 2.2.8-2.2ubuntu0.12.04.1
released
quantal
Fixed 2.2.8-2.2ubuntu1
released
Common Weakness Enumeration
References
http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
http://rhn.redhat.com/errata/RHSA-2012-1538.html
http://rhn.redhat.com/errata/RHSA-2012-1539.html
http://secunia.com/advisories/50124
http://secunia.com/advisories/50859
http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01903.html
http://www.openwall.com/lists/oss-security/2012/08/22/5
http://www.openwall.com/lists/oss-security/2012/08/22/6
http://www.securityfocus.com/bid/55167
http://xmpp.org/resources/security-notices/server-dialback/
https://bugzilla.redhat.com/show_bug.cgi?id=850872
https://github.com/Jabberd2/jabberd2/commit/aabcffae560d5fd00cd1d2ffce5d760353cf0a4d
http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
http://rhn.redhat.com/errata/RHSA-2012-1538.html
http://rhn.redhat.com/errata/RHSA-2012-1539.html
http://secunia.com/advisories/50124
http://secunia.com/advisories/50859
http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01903.html
http://www.openwall.com/lists/oss-security/2012/08/22/5
http://www.openwall.com/lists/oss-security/2012/08/22/6
http://www.securityfocus.com/bid/55167
http://xmpp.org/resources/security-notices/server-dialback/
https://bugzilla.redhat.com/show_bug.cgi?id=850872
https://github.com/Jabberd2/jabberd2/commit/aabcffae560d5fd00cd1d2ffce5d760353cf0a4d