The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.

Prosody 0.9.9 ============= A summary of changes: Security fixes
-------------- * Fix path traversal vulnerability in mod_http_files (CVE-2016-1231) * Fix use of weak PRNG in generation of dialback secrets (CVE-2016-1232) Bugs ---- * Improve handling of CNAME records in DNS * Fix traceback when deleting a user in some configurations (issue #496) * MUC: restrict_room_creation could prevent users from joining rooms (issue #458) * MUC: fix occasional dropping of iq stanzas sent privately between occupants * Fix a potential memory leak in mod_pep Additions --------- * Add http:list() command to telnet to view active HTTP services * Simplify IPv4/v6 address selection code for outgoing s2s * Add support for importing SCRAM hashes from ejabberd

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that in prosody, a Lightweight Jabber/XMPP server, used a weak PRNG in the mod_dialback module.

For Debian 6 Squeeze, this issue has been fixed in prosody version 0.7.0-1squeeze1+deb6u1.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Prosody Team reports :

Fix path traversal vulnerability in mod_http_files (CVE-2016-1231)

Fix use of weak PRNG in generation of dialback secrets (CVE-2016-1232)

Two vulnerabilities were discovered in Prosody, a lightweight Jabber/XMPP server. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2016-1231     Kim Alvefur discovered a flaw in Prosody's HTTP     file-serving module that allows it to serve requests     outside of the configured public root directory. A     remote attacker can exploit this flaw to access private     files including sensitive data. The default     configuration does not enable the mod_http_files module     and thus is not vulnerable.

  - CVE-2016-1232     Thijs Alkemade discovered that Prosody's generation of     the secret token for server-to-server dialback     authentication relied upon a weak random number     generator that was not cryptographically secure. A     remote attacker can take advantage of this flaw to guess     at probable values of the secret key and impersonate the     affected domain to other servers on the network.

ID	Name	Product	Family	Severity
89626	Fedora 22 : prosody-0.9.9-2.fc22 (2016-e289f41b76)	Nessus	Fedora Local Security Checks	high
89514	Fedora 23 : prosody-0.9.9-2.fc23 (2016-38e48069f8)	Nessus	Fedora Local Security Checks	high
87975	Debian DLA-391-1 : prosody security update	Nessus	Debian Local Security Checks	high
87907	FreeBSD : prosody -- multiple vulnerabilities (842cd117-ba54-11e5-9728-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
87829	Debian DSA-3439-1 : prosody - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-1232

high

Tenable Plugins

high

high

high

high

high