[SECURITY] [DSA 3463-1] prosody security update

2016-01-3118:15:48

lists.debian.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.008 Low

EPSS

Percentile

81.0%

JSON

Debian Security Advisory DSA-3463-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
January 31, 2016 https://www.debian.org/security/faq

Package : prosody
CVE ID : CVE-2016-0756

It was discovered that insecure handling of dialback keys may allow
a malicious XMPP server to impersonate another server.

For the oldstable distribution (wheezy), this problem has been fixed
in version 0.8.2-4+deb7u4.

For the stable distribution (jessie), this problem has been fixed in
version 0.9.7-2+deb8u3.

For the unstable distribution (sid), this problem has been fixed in
version 0.9.10-1.

We recommend that you upgrade your prosody packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8amd64prosody< 0.9.7-2+deb8u3prosody_0.9.7-2+deb8u3_amd64.deb
Debian7allprosody< 0.8.2-4+deb7u4prosody_0.8.2-4+deb7u4_all.deb
Debian7powerpcprosody< 0.8.2-4+deb7u4prosody_0.8.2-4+deb7u4_powerpc.deb
Debian8armhfprosody< 0.9.7-2+deb8u3prosody_0.9.7-2+deb8u3_armhf.deb
Debian6amd64prosody< 0.7.0-1squeeze1+deb6u2prosody_0.7.0-1squeeze1+deb6u2_amd64.deb
Debian6allprosody< 0.7.0-1squeeze1+deb6u2prosody_0.7.0-1squeeze1+deb6u2_all.deb
Debian7mipselprosody< 0.8.2-4+deb7u4prosody_0.8.2-4+deb7u4_mipsel.deb
Debian8kfreebsd-amd64prosody< 0.9.7-2+deb8u3prosody_0.9.7-2+deb8u3_kfreebsd-amd64.deb
Debian8powerpcprosody< 0.9.7-2+deb8u3prosody_0.9.7-2+deb8u3_powerpc.deb
Debian7kfreebsd-i386prosody< 0.8.2-4+deb7u4prosody_0.8.2-4+deb7u4_kfreebsd-i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	prosody	< 0.9.7-2+deb8u3	prosody_0.9.7-2+deb8u3_amd64.deb
Debian	7	all	prosody	< 0.8.2-4+deb7u4	prosody_0.8.2-4+deb7u4_all.deb
Debian	7	powerpc	prosody	< 0.8.2-4+deb7u4	prosody_0.8.2-4+deb7u4_powerpc.deb
Debian	8	armhf	prosody	< 0.9.7-2+deb8u3	prosody_0.9.7-2+deb8u3_armhf.deb
Debian	6	amd64	prosody	< 0.7.0-1squeeze1+deb6u2	prosody_0.7.0-1squeeze1+deb6u2_amd64.deb
Debian	6	all	prosody	< 0.7.0-1squeeze1+deb6u2	prosody_0.7.0-1squeeze1+deb6u2_all.deb
Debian	7	mipsel	prosody	< 0.8.2-4+deb7u4	prosody_0.8.2-4+deb7u4_mipsel.deb
Debian	8	kfreebsd-amd64	prosody	< 0.9.7-2+deb8u3	prosody_0.9.7-2+deb8u3_kfreebsd-amd64.deb
Debian	8	powerpc	prosody	< 0.9.7-2+deb8u3	prosody_0.9.7-2+deb8u3_powerpc.deb
Debian	7	kfreebsd-i386	prosody	< 0.8.2-4+deb7u4	prosody_0.8.2-4+deb7u4_kfreebsd-i386.deb