Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols.
{"id": "FEDORA:3669560C37DC", "vendorId": null, "type": "fedora", "bulletinFamily": "unix", "title": "[SECURITY] Fedora 22 Update: prosody-0.9.9-2.fc22", "description": "Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols. ", "published": "2016-01-21T04:52:34", "modified": "2016-01-21T04:52:34", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ORIHBH2H43AC5A3E6JPMF6FMTAITAGWV/", "reporter": "Fedora", "references": [], "cvelist": ["CVE-2016-1231", "CVE-2016-1232"], "immutableFields": [], "lastseen": "2020-12-21T08:17:53", "viewCount": 1, "enchantments": {"dependencies": {}, "score": {"value": 6.0, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2016-1231", "CVE-2016-1232"]}, {"type": "debian", "idList": ["DEBIAN:DLA-407-1:8E767"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2016-1231", "DEBIANCVE:CVE-2016-1232"]}, {"type": "fedora", "idList": ["FEDORA:AE47760200AF"]}, {"type": "freebsd", "idList": ["842CD117-BA54-11E5-9728-002590263BF5"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_842CD117BA5411E59728002590263BF5.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310703439"]}, {"type": "openwrt", "idList": ["OPENWRT-SA-000005"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2016-1231"]}]}, "exploitation": null, "vulnersScore": 6.0}, "_state": {"dependencies": 0}, "_internal": {}, "affectedPackage": [{"OS": "Fedora", "OSVersion": "22", "arch": "any", "packageName": "prosody", "packageVersion": "0.9.9", "packageFilename": "UNKNOWN", "operator": "lt"}]}
{"fedora": [{"lastseen": "2020-12-21T08:17:53", "description": "Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols. ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-01-20T22:00:48", "type": "fedora", "title": "[SECURITY] Fedora 23 Update: prosody-0.9.9-2.fc23", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1231", "CVE-2016-1232"], "modified": "2016-01-20T22:00:48", "id": "FEDORA:AE47760200AF", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6JOWGMWAQZH2NZDRSYKLJJT4Z6YX7KIW/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "openwrt": [{"lastseen": "2016-09-26T15:45:23", "description": "The prosody package has been rebuilt and was uploaded to the Chaos\nCalmer 15.05 repository due to multiple security issues.\n\n\nVERSION\n\n0.9.8-1 => 0.9.9-1\n\n\nCHANGELOG\n\n[Mon, 25 Jan 2016 13:31:29 +0100 bb23089]\n\nfixes:\n * path traversal vulnerability in mod_http_files (CVE-2016-1231)\n * use of weak PRNG in generation of dialback secrets (CVE-2016-1232)\n\n\nCHANGES\n\n net/prosody/Makefile | 4 ++--\n net/prosody/patches/010-fix-randomseed.patch | 12 ------------\n 2 files changed, 2 insertions(+), 14 deletions(-)", "cvss3": {}, "published": "2016-01-28T12:23:46", "type": "openwrt", "title": "prosody: Security update (2 CVEs)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2016-1232", "CVE-2016-1231"], "modified": "2016-01-28T12:23:46", "id": "OPENWRT-SA-000003", "href": "https://lists.openwrt.org/pipermail/openwrt-security-announce/2016-January/000003.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2016-09-26T15:45:23", "description": "The prosody package has been rebuilt and was uploaded to the Chaos\nCalmer 15.05 repository due to multiple security issues.\n\n\nVERSION\n\n0.9.8-1 => 0.9.9-1\n\n\nCHANGELOG\n\n[Mon, 25 Jan 2016 13:31:29 +0100 bb23089]\n\nfixes:\n * path traversal vulnerability in mod_http_files (CVE-2016-1231)\n * use of weak PRNG in generation of dialback secrets (CVE-2016-1232)\n\n\nCHANGES\n\n net/prosody/Makefile | 4 ++--\n net/prosody/patches/010-fix-randomseed.patch | 12 ------------\n 2 files changed, 2 insertions(+), 14 deletions(-)", "cvss3": {}, "published": "2016-01-28T12:25:32", "type": "openwrt", "title": "prosody: Security update (2 CVEs)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2016-1903", "CVE-2016-1232", "CVE-2016-1231"], "modified": "2016-01-28T12:25:32", "id": "OPENWRT-SA-000005", "href": "https://lists.openwrt.org/pipermail/openwrt-security-announce/2016-January/000005.html", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:PARTIAL/"}}], "openvas": [{"lastseen": "2019-05-29T18:35:48", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2016-01-21T00:00:00", "type": "openvas", "title": "Fedora Update for prosody FEDORA-2016-38", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1232", "CVE-2016-1231"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310806984", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806984", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for prosody FEDORA-2016-38\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806984\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-21 06:14:01 +0100 (Thu, 21 Jan 2016)\");\n script_cve_id(\"CVE-2016-1231\", \"CVE-2016-1232\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for prosody FEDORA-2016-38\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'prosody'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"prosody on Fedora 23\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-38\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175829.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC23\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC23\")\n{\n\n if ((res = isrpmvuln(pkg:\"prosody\", rpm:\"prosody~0.9.9~2.fc23\", rls:\"FC23\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2017-07-24T12:54:11", "description": "Two vulnerabilities were discovered\nin Prosody, a lightweight Jabber/XMPP server. The Common Vulnerabilities and\nExposures project identifies the following issues:\n\nCVE-2016-1231 \nKim Alvefur discovered a flaw in Prosody", "cvss3": {}, "published": "2016-01-10T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 3439-1 (prosody - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1232", "CVE-2016-1231"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:703439", "href": "http://plugins.openvas.org/nasl.php?oid=703439", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3439.nasl 6608 2017-07-07 12:05:05Z cfischer $\n# Auto-generated from advisory DSA 3439-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703439);\n script_version(\"$Revision: 6608 $\");\n script_cve_id(\"CVE-2016-1231\", \"CVE-2016-1232\");\n script_name(\"Debian Security Advisory DSA 3439-1 (prosody - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-07-07 14:05:05 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value: \"2016-01-10 00:00:00 +0100 (Sun, 10 Jan 2016)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2016/dsa-3439.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"prosody on Debian Linux\");\n script_tag(name: \"insight\", value: \"Prosody IM is a simple-to-use XMPP\nserver. It is designed to be easy to extend via plugins, and light on\nresources.\");\n script_tag(name: \"solution\", value: \"For the oldstable distribution\n(wheezy), these problems have been fixed in version 0.8.2-4+deb7u3.\n\nFor the stable distribution (jessie), these problems have been fixed in\nversion 0.9.7-2+deb8u2.\n\nWe recommend that you upgrade your prosody packages.\");\n script_tag(name: \"summary\", value: \"Two vulnerabilities were discovered\nin Prosody, a lightweight Jabber/XMPP server. The Common Vulnerabilities and\nExposures project identifies the following issues:\n\nCVE-2016-1231 \nKim Alvefur discovered a flaw in Prosody's HTTP file-serving module\nthat allows it to serve requests outside of the configured public\nroot directory. A remote attacker can exploit this flaw to access\nprivate files including sensitive data. The default configuration\ndoes not enable the mod_http_files module and thus is not\nvulnerable.\n\nCVE-2016-1232 \nThijs Alkemade discovered that Prosody's generation of the secret\ntoken for server-to-server dialback authentication relied upon a\nweak random number generator that was not cryptographically secure.\nA remote attacker can take advantage of this flaw to guess at\nprobable values of the secret key and impersonate the affected\ndomain to other servers on the network.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed\nsoftware version using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"prosody\", ver:\"0.9.7-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"prosody\", ver:\"0.8.2-4+deb7u3\", rls_regex:\"DEB7.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2019-05-29T18:35:48", "description": "Two vulnerabilities were discovered\nin Prosody, a lightweight Jabber/XMPP server. The Common Vulnerabilities and\nExposures project identifies the following issues:\n\nCVE-2016-1231\nKim Alvefur discovered a flaw in Prosody", "cvss3": {}, "published": "2016-01-10T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 3439-1 (prosody - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1232", "CVE-2016-1231"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310703439", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703439", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3439.nasl 14279 2019-03-18 14:48:34Z cfischer $\n# Auto-generated from advisory DSA 3439-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703439\");\n script_version(\"$Revision: 14279 $\");\n script_cve_id(\"CVE-2016-1231\", \"CVE-2016-1232\");\n script_name(\"Debian Security Advisory DSA 3439-1 (prosody - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:48:34 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-10 00:00:00 +0100 (Sun, 10 Jan 2016)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2016/dsa-3439.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(8|7)\");\n script_tag(name:\"affected\", value:\"prosody on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution\n(wheezy), these problems have been fixed in version 0.8.2-4+deb7u3.\n\nFor the stable distribution (jessie), these problems have been fixed in\nversion 0.9.7-2+deb8u2.\n\nWe recommend that you upgrade your prosody packages.\");\n script_tag(name:\"summary\", value:\"Two vulnerabilities were discovered\nin Prosody, a lightweight Jabber/XMPP server. The Common Vulnerabilities and\nExposures project identifies the following issues:\n\nCVE-2016-1231\nKim Alvefur discovered a flaw in Prosody's HTTP file-serving module\nthat allows it to serve requests outside of the configured public\nroot directory. A remote attacker can exploit this flaw to access\nprivate files including sensitive data. The default configuration\ndoes not enable the mod_http_files module and thus is not\nvulnerable.\n\nCVE-2016-1232\nThijs Alkemade discovered that Prosody's generation of the secret\ntoken for server-to-server dialback authentication relied upon a\nweak random number generator that was not cryptographically secure.\nA remote attacker can take advantage of this flaw to guess at\nprobable values of the secret key and impersonate the affected\ndomain to other servers on the network.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed\nsoftware version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"prosody\", ver:\"0.9.7-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"prosody\", ver:\"0.8.2-4+deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "debian": [{"lastseen": "2022-02-01T00:00:00", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3439-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nJanuary 10, 2016 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : prosody\nCVE ID : CVE-2016-1231 CVE-2016-1232\n\nTwo vulnerabilities were discovered in Prosody, a lightweight\nJabber/XMPP server. The Common Vulnerabilities and Exposures project\nidentifies the following issues:\n\nCVE-2016-1231\n\n Kim Alvefur discovered a flaw in Prosody's HTTP file-serving module\n that allows it to serve requests outside of the configured public\n root directory. A remote attacker can exploit this flaw to access\n private files including sensitive data. The default configuration\n does not enable the mod_http_files module and thus is not\n vulnerable.\n\nCVE-2016-1232\n\n Thijs Alkemade discovered that Prosody's generation of the secret\n token for server-to-server dialback authentication relied upon a\n weak random number generator that was not cryptographically secure.\n A remote attacker can take advantage of this flaw to guess at\n probable values of the secret key and impersonate the affected\n domain to other servers on the network.\n\nFor the oldstable distribution (wheezy), these problems have been fixed\nin version 0.8.2-4+deb7u3.\n\nFor the stable distribution (jessie), these problems have been fixed in\nversion 0.9.7-2+deb8u2.\n\nWe recommend that you upgrade your prosody packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-01-10T10:07:09", "type": "debian", "title": "[SECURITY] [DSA 3439-1] prosody security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1231", "CVE-2016-1232"], "modified": "2016-01-10T10:07:09", "id": "DEBIAN:DSA-3439-1:10603", "href": "https://lists.debian.org/debian-security-announce/2016/msg00007.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-10-21T22:38:18", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3439-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nJanuary 10, 2016 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : prosody\nCVE ID : CVE-2016-1231 CVE-2016-1232\n\nTwo vulnerabilities were discovered in Prosody, a lightweight\nJabber/XMPP server. The Common Vulnerabilities and Exposures project\nidentifies the following issues:\n\nCVE-2016-1231\n\n Kim Alvefur discovered a flaw in Prosody's HTTP file-serving module\n that allows it to serve requests outside of the configured public\n root directory. A remote attacker can exploit this flaw to access\n private files including sensitive data. The default configuration\n does not enable the mod_http_files module and thus is not\n vulnerable.\n\nCVE-2016-1232\n\n Thijs Alkemade discovered that Prosody's generation of the secret\n token for server-to-server dialback authentication relied upon a\n weak random number generator that was not cryptographically secure.\n A remote attacker can take advantage of this flaw to guess at\n probable values of the secret key and impersonate the affected\n domain to other servers on the network.\n\nFor the oldstable distribution (wheezy), these problems have been fixed\nin version 0.8.2-4+deb7u3.\n\nFor the stable distribution (jessie), these problems have been fixed in\nversion 0.9.7-2+deb8u2.\n\nWe recommend that you upgrade your prosody packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-01-10T10:07:09", "type": "debian", "title": "[SECURITY] [DSA 3439-1] prosody security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1231", "CVE-2016-1232"], "modified": "2016-01-10T10:07:09", "id": "DEBIAN:DSA-3439-1:CE2E2", "href": "https://lists.debian.org/debian-security-announce/2016/msg00007.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-15T16:40:22", "description": "Package : prosody\nVersion : 0.7.0-1squeeze1+deb6u1\nCVE ID : CVE-2016-1232\n\nIt was discovered that in prosody, a Lightweight Jabber/XMPP server,\nused a weak PRNG in the mod_dialback module.\n\nFor Debian 6 Squeeze, this issue has been fixed in prosody version\n0.7.0-1squeeze1+deb6u1.\n\n\nRegards,\n\n- -- \n ,''`.\n : :' : Chris Lamb\n `. `'` lamby@debian.org / chris-lamb.co.uk\n `-", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-01-16T09:35:13", "type": "debian", "title": "[SECURITY] [DLA 391-1] prosody security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1232"], "modified": "2016-01-16T09:35:13", "id": "DEBIAN:DLA-391-1:DD087", "href": "https://lists.debian.org/debian-lts-announce/2016/01/msg00015.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-22T04:53:48", "description": "Package : prosody\nVersion : 0.7.0-1squeeze1+deb6u2\nCVE ID : CVE-2016-0756\n\nThe flaw allows a malicious server to impersonate the vulnerable domain\nto any XMPP domain whose domain name includes the attacker's domain as a\nsuffix.\n\nFor example, 'bber.example' would be able to connect to 'jabber.example'\nand successfully impersonate any vulnerable server on the network.\n\nThis release also fixes a regression introduced in the previous\nCVE-2016-1232 fix: s2s doesn't work if /dev/urandom is read-only.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-01-30T22:52:48", "type": "debian", "title": "[SECURITY] [DLA 407-1] prosody security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-0756", "CVE-2016-1232"], "modified": "2016-01-30T22:52:48", "id": "DEBIAN:DLA-407-1:8E767", "href": "https://lists.debian.org/debian-lts-announce/2016/01/msg00032.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "nessus": [{"lastseen": "2021-08-19T12:42:59", "description": "Prosody 0.9.9 ============= A summary of changes: Security fixes\n-------------- * Fix path traversal vulnerability in mod_http_files (CVE-2016-1231) * Fix use of weak PRNG in generation of dialback secrets (CVE-2016-1232) Bugs ---- * Improve handling of CNAME records in DNS * Fix traceback when deleting a user in some configurations (issue #496) * MUC: restrict_room_creation could prevent users from joining rooms (issue #458) * MUC: fix occasional dropping of iq stanzas sent privately between occupants * Fix a potential memory leak in mod_pep Additions --------- * Add http:list() command to telnet to view active HTTP services * Simplify IPv4/v6 address selection code for outgoing s2s * Add support for importing SCRAM hashes from ejabberd\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "published": "2016-03-04T00:00:00", "type": "nessus", "title": "Fedora 23 : prosody-0.9.9-2.fc23 (2016-38e48069f8)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1231", "CVE-2016-1232"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:prosody", "cpe:/o:fedoraproject:fedora:23"], "id": "FEDORA_2016-38E48069F8.NASL", "href": "https://www.tenable.com/plugins/nessus/89514", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-38e48069f8.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(89514);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-1231\", \"CVE-2016-1232\");\n script_xref(name:\"FEDORA\", value:\"2016-38e48069f8\");\n\n script_name(english:\"Fedora 23 : prosody-0.9.9-2.fc23 (2016-38e48069f8)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Prosody 0.9.9 ============= A summary of changes: Security fixes\n-------------- * Fix path traversal vulnerability in mod_http_files\n(CVE-2016-1231) * Fix use of weak PRNG in generation of dialback\nsecrets (CVE-2016-1232) Bugs ---- * Improve handling of CNAME records\nin DNS * Fix traceback when deleting a user in some configurations\n(issue #496) * MUC: restrict_room_creation could prevent users from\njoining rooms (issue #458) * MUC: fix occasional dropping of iq\nstanzas sent privately between occupants * Fix a potential memory leak\nin mod_pep Additions --------- * Add http:list() command to telnet to\nview active HTTP services * Simplify IPv4/v6 address selection code\nfor outgoing s2s * Add support for importing SCRAM hashes from\nejabberd\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296983\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296984\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175829.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?780f4759\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected prosody package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:prosody\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:23\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^23([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 23.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC23\", reference:\"prosody-0.9.9-2.fc23\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"prosody\");\n}\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:43:32", "description": "The Prosody Team reports :\n\nFix path traversal vulnerability in mod_http_files (CVE-2016-1231)\n\nFix use of weak PRNG in generation of dialback secrets (CVE-2016-1232)", "cvss3": {"score": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "published": "2016-01-14T00:00:00", "type": "nessus", "title": "FreeBSD : prosody -- multiple vulnerabilities (842cd117-ba54-11e5-9728-002590263bf5)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1231", "CVE-2016-1232"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:prosody", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_842CD117BA5411E59728002590263BF5.NASL", "href": "https://www.tenable.com/plugins/nessus/87907", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(87907);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2016-1231\", \"CVE-2016-1232\");\n\n script_name(english:\"FreeBSD : prosody -- multiple vulnerabilities (842cd117-ba54-11e5-9728-002590263bf5)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The Prosody Team reports :\n\nFix path traversal vulnerability in mod_http_files (CVE-2016-1231)\n\nFix use of weak PRNG in generation of dialback secrets (CVE-2016-1232)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=206150\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://blog.prosody.im/prosody-0-9-9-security-release/\"\n );\n # https://vuxml.freebsd.org/freebsd/842cd117-ba54-11e5-9728-002590263bf5.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?dfd2b464\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:prosody\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/01/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"prosody<0.9.9\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:43:50", "description": "Two vulnerabilities were discovered in Prosody, a lightweight Jabber/XMPP server. The Common Vulnerabilities and Exposures project identifies the following issues :\n\n - CVE-2016-1231 Kim Alvefur discovered a flaw in Prosody's HTTP file-serving module that allows it to serve requests outside of the configured public root directory. A remote attacker can exploit this flaw to access private files including sensitive data. The default configuration does not enable the mod_http_files module and thus is not vulnerable.\n\n - CVE-2016-1232 Thijs Alkemade discovered that Prosody's generation of the secret token for server-to-server dialback authentication relied upon a weak random number generator that was not cryptographically secure. A remote attacker can take advantage of this flaw to guess at probable values of the secret key and impersonate the affected domain to other servers on the network.", "cvss3": {"score": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "published": "2016-01-11T00:00:00", "type": "nessus", "title": "Debian DSA-3439-1 : prosody - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1231", "CVE-2016-1232"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:prosody", "cpe:/o:debian:debian_linux:7.0", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DSA-3439.NASL", "href": "https://www.tenable.com/plugins/nessus/87829", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3439. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(87829);\n script_version(\"2.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-1231\", \"CVE-2016-1232\");\n script_xref(name:\"DSA\", value:\"3439\");\n\n script_name(english:\"Debian DSA-3439-1 : prosody - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two vulnerabilities were discovered in Prosody, a lightweight\nJabber/XMPP server. The Common Vulnerabilities and Exposures project\nidentifies the following issues :\n\n - CVE-2016-1231\n Kim Alvefur discovered a flaw in Prosody's HTTP\n file-serving module that allows it to serve requests\n outside of the configured public root directory. A\n remote attacker can exploit this flaw to access private\n files including sensitive data. The default\n configuration does not enable the mod_http_files module\n and thus is not vulnerable.\n\n - CVE-2016-1232\n Thijs Alkemade discovered that Prosody's generation of\n the secret token for server-to-server dialback\n authentication relied upon a weak random number\n generator that was not cryptographically secure. A\n remote attacker can take advantage of this flaw to guess\n at probable values of the secret key and impersonate the\n affected domain to other servers on the network.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1231\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1232\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/prosody\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/prosody\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2016/dsa-3439\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the prosody packages.\n\nFor the oldstable distribution (wheezy), these problems have been\nfixed in version 0.8.2-4+deb7u3.\n\nFor the stable distribution (jessie), these problems have been fixed\nin version 0.9.7-2+deb8u2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:prosody\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"prosody\", reference:\"0.8.2-4+deb7u3\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"prosody\", reference:\"0.9.7-2+deb8u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:42:49", "description": "Prosody 0.9.9 ============= A summary of changes: Security fixes\n-------------- * Fix path traversal vulnerability in mod_http_files (CVE-2016-1231) * Fix use of weak PRNG in generation of dialback secrets (CVE-2016-1232) Bugs ---- * Improve handling of CNAME records in DNS * Fix traceback when deleting a user in some configurations (issue #496) * MUC: restrict_room_creation could prevent users from joining rooms (issue #458) * MUC: fix occasional dropping of iq stanzas sent privately between occupants * Fix a potential memory leak in mod_pep Additions --------- * Add http:list() command to telnet to view active HTTP services * Simplify IPv4/v6 address selection code for outgoing s2s * Add support for importing SCRAM hashes from ejabberd\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "published": "2016-03-04T00:00:00", "type": "nessus", "title": "Fedora 22 : prosody-0.9.9-2.fc22 (2016-e289f41b76)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1231", "CVE-2016-1232"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:prosody", "cpe:/o:fedoraproject:fedora:22"], "id": "FEDORA_2016-E289F41B76.NASL", "href": "https://www.tenable.com/plugins/nessus/89626", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2016-e289f41b76.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(89626);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-1231\", \"CVE-2016-1232\");\n script_xref(name:\"FEDORA\", value:\"2016-e289f41b76\");\n\n script_name(english:\"Fedora 22 : prosody-0.9.9-2.fc22 (2016-e289f41b76)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Prosody 0.9.9 ============= A summary of changes: Security fixes\n-------------- * Fix path traversal vulnerability in mod_http_files\n(CVE-2016-1231) * Fix use of weak PRNG in generation of dialback\nsecrets (CVE-2016-1232) Bugs ---- * Improve handling of CNAME records\nin DNS * Fix traceback when deleting a user in some configurations\n(issue #496) * MUC: restrict_room_creation could prevent users from\njoining rooms (issue #458) * MUC: fix occasional dropping of iq\nstanzas sent privately between occupants * Fix a potential memory leak\nin mod_pep Additions --------- * Add http:list() command to telnet to\nview active HTTP services * Simplify IPv4/v6 address selection code\nfor outgoing s2s * Add support for importing SCRAM hashes from\nejabberd\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296983\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1296984\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175868.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?27e90732\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected prosody package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:prosody\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"prosody-0.9.9-2.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"prosody\");\n}\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:43:28", "description": "It was discovered that in prosody, a Lightweight Jabber/XMPP server, used a weak PRNG in the mod_dialback module.\n\nFor Debian 6 Squeeze, this issue has been fixed in prosody version 0.7.0-1squeeze1+deb6u1.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "published": "2016-01-19T00:00:00", "type": "nessus", "title": "Debian DLA-391-1 : prosody security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1232"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:prosody", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DLA-391.NASL", "href": "https://www.tenable.com/plugins/nessus/87975", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-391-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(87975);\n script_version(\"2.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-1232\");\n\n script_name(english:\"Debian DLA-391-1 : prosody security update\");\n script_summary(english:\"Checks dpkg output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that in prosody, a Lightweight Jabber/XMPP server,\nused a weak PRNG in the mod_dialback module.\n\nFor Debian 6 Squeeze, this issue has been fixed in prosody version\n0.7.0-1squeeze1+deb6u1.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2016/01/msg00015.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze-lts/prosody\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Upgrade the affected prosody package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:prosody\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"prosody\", reference:\"0.7.0-1squeeze1+deb6u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-03-27T14:45:18", "description": "The flaw allows a malicious server to impersonate the vulnerable domain to any XMPP domain whose domain name includes the attacker's domain as a suffix.\n\nFor example, 'bber.example' would be able to connect to 'jabber.example' and successfully impersonate any vulnerable server on the network.\n\nThis release also fixes a regression introduced in the previous CVE-2016-1232 fix: s2s doesn't work if /dev/urandom is read-only.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 5.3, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "published": "2016-02-01T00:00:00", "type": "nessus", "title": "Debian DLA-407-1 : prosody security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-0756", "CVE-2016-1232"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:prosody", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DLA-407.NASL", "href": "https://www.tenable.com/plugins/nessus/88493", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-407-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88493);\n script_version(\"2.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-0756\");\n\n script_name(english:\"Debian DLA-407-1 : prosody security update\");\n script_summary(english:\"Checks dpkg output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The flaw allows a malicious server to impersonate the vulnerable\ndomain to any XMPP domain whose domain name includes the attacker's\ndomain as a suffix.\n\nFor example, 'bber.example' would be able to connect to\n'jabber.example' and successfully impersonate any vulnerable server on\nthe network.\n\nThis release also fixes a regression introduced in the previous\nCVE-2016-1232 fix: s2s doesn't work if /dev/urandom is read-only.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2016/01/msg00032.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze-lts/prosody\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Upgrade the affected prosody package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:prosody\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"prosody\", reference:\"0.7.0-1squeeze1+deb6u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "freebsd": [{"lastseen": "2022-01-19T15:51:32", "description": "\n\nThe Prosody Team reports:\n\nFix path traversal vulnerability in mod_http_files\n\t (CVE-2016-1231)\nFix use of weak PRNG in generation of dialback secrets\n\t (CVE-2016-1232)\n\n\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-01-08T00:00:00", "type": "freebsd", "title": "prosody -- multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1231", "CVE-2016-1232"], "modified": "2016-01-08T00:00:00", "id": "842CD117-BA54-11E5-9728-002590263BF5", "href": "https://vuxml.freebsd.org/freebsd/842cd117-ba54-11e5-9728-002590263bf5.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "cve": [{"lastseen": "2022-03-23T12:31:50", "description": "Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) in an unspecified path.", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.9, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2016-01-12T20:59:00", "type": "cve", "title": "CVE-2016-1231", "cwe": ["CWE-22"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1231"], "modified": "2016-06-15T16:48:00", "cpe": ["cpe:/a:prosody:prosody:0.9.4", "cpe:/a:prosody:prosody:0.9.2", "cpe:/o:fedoraproject:fedora:22", "cpe:/o:fedoraproject:fedora:23", "cpe:/o:debian:debian_linux:7.0", "cpe:/a:prosody:prosody:0.9.0", "cpe:/a:prosody:prosody:0.9.3", "cpe:/a:prosody:prosody:0.9.5", "cpe:/a:prosody:prosody:0.9.8", "cpe:/a:prosody:prosody:0.9.7", "cpe:/a:prosody:prosody:0.9.1", "cpe:/a:prosody:prosody:0.9.6", "cpe:/o:debian:debian_linux:8.0"], "id": "CVE-2016-1231", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1231", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:prosody:prosody:0.9.4:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.5:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.7:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.6:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.8:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.3:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T12:31:34", "description": "The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2016-01-12T20:59:00", "type": "cve", "title": "CVE-2016-1232", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1232"], "modified": "2016-06-09T11:39:00", "cpe": ["cpe:/a:prosody:prosody:0.9.4", "cpe:/a:prosody:prosody:0.9.2", "cpe:/o:fedoraproject:fedora:22", "cpe:/o:fedoraproject:fedora:23", "cpe:/o:debian:debian_linux:7.0", "cpe:/a:prosody:prosody:0.9.0", "cpe:/a:prosody:prosody:0.9.3", "cpe:/a:prosody:prosody:0.9.5", "cpe:/a:prosody:prosody:0.9.8", "cpe:/a:prosody:prosody:0.9.7", "cpe:/a:prosody:prosody:0.9.1", "cpe:/a:prosody:prosody:0.9.6", "cpe:/o:debian:debian_linux:8.0"], "id": "CVE-2016-1232", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1232", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:prosody:prosody:0.9.4:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.5:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.7:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.6:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.8:*:*:*:*:*:*:*", "cpe:2.3:a:prosody:prosody:0.9.3:*:*:*:*:*:*:*"]}], "ubuntucve": [{"lastseen": "2021-11-22T21:48:00", "description": "Directory traversal vulnerability in the HTTP file-serving module\n(mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to\nread arbitrary files via a .. (dot dot) in an unspecified path.", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.9, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-01-12T00:00:00", "type": "ubuntucve", "title": "CVE-2016-1231", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1231"], "modified": "2016-01-12T00:00:00", "id": "UB:CVE-2016-1231", "href": "https://ubuntu.com/security/CVE-2016-1231", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-11-22T21:48:00", "description": "The mod_dialback module in Prosody before 0.9.9 does not properly generate\nrandom values for the secret token for server-to-server dialback\nauthentication, which makes it easier for attackers to spoof servers via a\nbrute force attack.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2016-01-12T00:00:00", "type": "ubuntucve", "title": "CVE-2016-1232", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1232"], "modified": "2016-01-12T00:00:00", "id": "UB:CVE-2016-1232", "href": "https://ubuntu.com/security/CVE-2016-1232", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "debiancve": [{"lastseen": "2022-06-15T06:03:55", "description": "Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) in an unspecified path.", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.9, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2016-01-12T20:59:00", "type": "debiancve", "title": "CVE-2016-1231", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1231"], "modified": "2016-01-12T20:59:00", "id": "DEBIANCVE:CVE-2016-1231", "href": "https://security-tracker.debian.org/tracker/CVE-2016-1231", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-06-15T06:03:55", "description": "The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2016-01-12T20:59:00", "type": "debiancve", "title": "CVE-2016-1232", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1232"], "modified": "2016-01-12T20:59:00", "id": "DEBIANCVE:CVE-2016-1232", "href": "https://security-tracker.debian.org/tracker/CVE-2016-1232", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}]}
[SECURITY] Fedora 22 Update: prosody-0.9.9-2.fc22
