PT-2014-4899 · Prosody+1 · Prosody+1

Publicado 2014-04-11 · Atualizado 2014-04-19 · CVE-2014-2744

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.9.4 Lightwitch Metronome versions prior to 3.5

Description The issue allows remote attackers to cause a denial of service due to resource consumption via compressed XML elements in an XMPP stream. This type of attack is referred to as an "xmppbomb" attack. It occurs when stream compression is negotiated while a session is unauthenticated.

Recommendations For Prosody versions prior to 0.9.4, update to version 0.9.4 or later to resolve the issue. For Lightwitch Metronome versions prior to 3.5, update to version 3.5 or later to resolve the issue. As a temporary workaround, consider disabling stream compression negotiation for unauthenticated sessions until a patch is available.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-2744

DSA-2895-1

Produtos afetados

Lightwitch Metronome

Prosody

Referências · 12

• 🔥 http://code.lightwitch.org/metronome/rev/49f47277a411 · Exploit
• 🔥 http://hg.prosody.im/0.9/rev/b3b1c9da38fb · Exploit
• http://openwall.com/lists/oss-security/2014/04/09/1 · Nota
• http://debian.org/security/2014/dsa-2895 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-2744 · Nota de Segurança
• http://secunia.com/advisories/57710 · Nota
• https://security-tracker.debian.org/tracker/CVE-2014-2744 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-2744 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/04/07/7 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2744 · Aviso do Fabricante
• http://blog.prosody.im/prosody-0-9-4-released · Aviso do Fabricante
• http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas · Nota