CVE-2012-3525

2012-08-2500:00:00

ubuntu.com

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.005 Low

EPSS

Percentile

77.1%

JSON

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was
made for an XMPP Server Dialback response, which allows remote XMPP servers
to spoof domains via a (1) Verify Response or (2) Authorization Response.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=850872>

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchjabberd2< 2.0s11-1ubuntu4.2UNKNOWN
ubuntu10.04noarchjabberd2< 2.2.8-2ubuntu4.0.10.04.2UNKNOWN
ubuntu11.10noarchjabberd2< 2.2.8-2ubuntu6.1UNKNOWN
ubuntu12.04noarchjabberd2< 2.2.8-2.2ubuntu0.12.04.1UNKNOWN
ubuntu12.10noarchjabberd2< 2.2.8-2.2ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	jabberd2	< 2.0s11-1ubuntu4.2	UNKNOWN
ubuntu	10.04	noarch	jabberd2	< 2.2.8-2ubuntu4.0.10.04.2	UNKNOWN
ubuntu	11.10	noarch	jabberd2	< 2.2.8-2ubuntu6.1	UNKNOWN
ubuntu	12.04	noarch	jabberd2	< 2.2.8-2.2ubuntu0.12.04.1	UNKNOWN
ubuntu	12.10	noarch	jabberd2	< 2.2.8-2.2ubuntu1	UNKNOWN