Back to Database
Status published
Medium
CVE-2012-3525
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that...
Vulnerability Description
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-3525
Credits & Attribution
No credits recorded in the NVD database.
References
- http://rhn.redhat.com/errata/RHSA-2012-1538.html
- http://www.openwall.com/lists/oss-security/2012/08/22/5
- http://www.openwall.com/lists/oss-security/2012/08/22/6
- http://www.securityfocus.com/bid/55167
- http://secunia.com/advisories/50124
- https://bugzilla.redhat.com/show_bug.cgi?id=850872
- http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
- http://xmpp.org/resources/security-notices/server-dialback/
- https://github.com/Jabberd2/jabberd2/commit/aabcffae560d5fd00cd1d2ffce5d760353cf0a4d
- http://rhn.redhat.com/errata/RHSA-2012-1539.html
- http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01903.html
- http://secunia.com/advisories/50859
Affected Vendor
jabber2
View all reports →Affected Software
jabberd2
Vulnerable Versions:
2.1.19, 0, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.14, 2.1.15, 2.1.16, 2.1.17, 2.1.18, 2.1.20, 2.1.21, 2.1.22, 2.1.23, 2.1.24, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.7.1, 2.2.8, 2.2.9, 2.2.10, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15
Timeline
Official Publish:
August 25th, 2012
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.