CVE

Id
87052  
CVE No.
CVE-2016-0756  
Status
Candidate  
Description
The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.  
Phase
Assigned (20151216)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
761981 87052 CVE-2016-0756 MLIST:[oss-security] 20160127 CVE-2016-0756: Prosody XMPP server: insecure dialback key generation/validation algorithm  View
761982 87052 CVE-2016-0756 URL:http://www.openwall.com/lists/oss-security/2016/01/27/10  View
761983 87052 CVE-2016-0756 CONFIRM:http://blog.prosody.im/prosody-0-9-10-released/  View
761984 87052 CVE-2016-0756 CONFIRM:https://prosody.im/issues/issue/596  View
761985 87052 CVE-2016-0756 CONFIRM:https://prosody.im/security/advisory_20160127/  View
761986 87052 CVE-2016-0756 DEBIAN:DSA-3463  View
761987 87052 CVE-2016-0756 URL:http://www.debian.org/security/2016/dsa-3463  View
761988 87052 CVE-2016-0756 FEDORA:FEDORA-2016-e2c5111eda  View
761989 87052 CVE-2016-0756 URL:http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176796.html  View
761990 87052 CVE-2016-0756 FEDORA:FEDORA-2016-5a5c85c5a8  View
761991 87052 CVE-2016-0756 URL:http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176914.html  View
761992 87052 CVE-2016-0756 BID:82241  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
1390 JVNDB-2016-002163 Android の Download Manager におけるプライベートストレージのファイルアクセス制限を回避される脆弱性 Android の Download Manager には、競合状態により、プライベートストレージのファイルアクセス制限を回避される脆弱性が存在します。 CVE-2016-0848 87052 7.2 8.4 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002163.html  View