PT-2014-4899 · Prosody+1 · Prosody+1

Published 2014-04-11 · Updated 2014-04-19 · CVE-2014-2744

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.9.4 Lightwitch Metronome versions prior to 3.5

Description The issue allows remote attackers to cause a denial of service due to resource consumption via compressed XML elements in an XMPP stream. This type of attack is referred to as an "xmppbomb" attack. It occurs when stream compression is negotiated while a session is unauthenticated.

Recommendations For Prosody versions prior to 0.9.4, update to version 0.9.4 or later to resolve the issue. For Lightwitch Metronome versions prior to 3.5, update to version 3.5 or later to resolve the issue. As a temporary workaround, consider disabling stream compression negotiation for unauthenticated sessions until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-2744

DSA-2895-1

Affected Products

Lightwitch Metronome

Prosody

References · 12

• 🔥 http://code.lightwitch.org/metronome/rev/49f47277a411 · Exploit
• 🔥 http://hg.prosody.im/0.9/rev/b3b1c9da38fb · Exploit
• http://debian.org/security/2014/dsa-2895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2744 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-2744 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-2744 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2744 · Vendor Advisory
• http://blog.prosody.im/prosody-0-9-4-released · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/04/09/1 · Note
• http://secunia.com/advisories/57710 · Note
• http://openwall.com/lists/oss-security/2014/04/07/7 · Note
• http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas · Note