[SECURITY] [DLA 407-1] prosody security update

2016-01-3022:52:48

lists.debian.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.008 Low

EPSS

Percentile

81.0%

JSON

Package : prosody
Version : 0.7.0-1squeeze1+deb6u2
CVE ID : CVE-2016-0756

The flaw allows a malicious server to impersonate the vulnerable domain
to any XMPP domain whose domain name includes the attacker's domain as a
suffix.

For example, 'bber.example' would be able to connect to 'jabber.example'
and successfully impersonate any vulnerable server on the network.

This release also fixes a regression introduced in the previous
CVE-2016-1232 fix: s2s doesn't work if /dev/urandom is read-only.

OSVersionArchitecturePackageVersionFilename
Debian8s390xprosody< 0.9.7-2+deb8u3prosody_0.9.7-2+deb8u3_s390x.deb
Debian7kfreebsd-i386prosody< 0.8.2-4+deb7u4prosody_0.8.2-4+deb7u4_kfreebsd-i386.deb
Debian7s390prosody< 0.8.2-4+deb7u4prosody_0.8.2-4+deb7u4_s390.deb
Debian6i386prosody< 0.7.0-1squeeze1+deb6u2prosody_0.7.0-1squeeze1+deb6u2_i386.deb
Debian8kfreebsd-amd64prosody< 0.9.7-2+deb8u3prosody_0.9.7-2+deb8u3_kfreebsd-amd64.deb
Debian7allprosody< 0.8.2-4+deb7u4prosody_0.8.2-4+deb7u4_all.deb
Debian6amd64prosody< 0.7.0-1squeeze1+deb6u2prosody_0.7.0-1squeeze1+deb6u2_amd64.deb
Debian7powerpcprosody< 0.8.2-4+deb7u4prosody_0.8.2-4+deb7u4_powerpc.deb
Debian8i386prosody< 0.9.7-2+deb8u3prosody_0.9.7-2+deb8u3_i386.deb
Debian8mipselprosody< 0.9.7-2+deb8u3prosody_0.9.7-2+deb8u3_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	s390x	prosody	< 0.9.7-2+deb8u3	prosody_0.9.7-2+deb8u3_s390x.deb
Debian	7	kfreebsd-i386	prosody	< 0.8.2-4+deb7u4	prosody_0.8.2-4+deb7u4_kfreebsd-i386.deb
Debian	7	s390	prosody	< 0.8.2-4+deb7u4	prosody_0.8.2-4+deb7u4_s390.deb
Debian	6	i386	prosody	< 0.7.0-1squeeze1+deb6u2	prosody_0.7.0-1squeeze1+deb6u2_i386.deb
Debian	8	kfreebsd-amd64	prosody	< 0.9.7-2+deb8u3	prosody_0.9.7-2+deb8u3_kfreebsd-amd64.deb
Debian	7	all	prosody	< 0.8.2-4+deb7u4	prosody_0.8.2-4+deb7u4_all.deb
Debian	6	amd64	prosody	< 0.7.0-1squeeze1+deb6u2	prosody_0.7.0-1squeeze1+deb6u2_amd64.deb
Debian	7	powerpc	prosody	< 0.8.2-4+deb7u4	prosody_0.8.2-4+deb7u4_powerpc.deb
Debian	8	i386	prosody	< 0.9.7-2+deb8u3	prosody_0.9.7-2+deb8u3_i386.deb
Debian	8	mipsel	prosody	< 0.9.7-2+deb8u3	prosody_0.9.7-2+deb8u3_mipsel.deb