Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.0058
prosody security update
11 January 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: prosody
Publisher: Debian
Operating System: Debian GNU/Linux 7
Debian GNU/Linux 8
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2016-1232 CVE-2016-1231
Original Bulletin:
http://www.debian.org/security/2016/dsa-3439
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running prosody check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3439-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
January 10, 2016 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : prosody
CVE ID : CVE-2016-1231 CVE-2016-1232
Two vulnerabilities were discovered in Prosody, a lightweight
Jabber/XMPP server. The Common Vulnerabilities and Exposures project
identifies the following issues:
CVE-2016-1231
Kim Alvefur discovered a flaw in Prosody's HTTP file-serving module
that allows it to serve requests outside of the configured public
root directory. A remote attacker can exploit this flaw to access
private files including sensitive data. The default configuration
does not enable the mod_http_files module and thus is not
vulnerable.
CVE-2016-1232
Thijs Alkemade discovered that Prosody's generation of the secret
token for server-to-server dialback authentication relied upon a
weak random number generator that was not cryptographically secure.
A remote attacker can take advantage of this flaw to guess at
probable values of the secret key and impersonate the affected
domain to other servers on the network.
For the oldstable distribution (wheezy), these problems have been fixed
in version 0.8.2-4+deb7u3.
For the stable distribution (jessie), these problems have been fixed in
version 0.9.7-2+deb8u2.
We recommend that you upgrade your prosody packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJWki0fAAoJEAVMuPMTQ89Ey8gP/3F2x/W0Zq+4Ps19wH8U8iuf
WlElUNs9jXvlMYU80992REDnCODpO3jEx5Y734vk4Jpy2LXbtmfCeniaFaA3ewE7
Ozv952+Hxlue+J66ji6ITpW2totoU1LmgilLrlAZv6gpqBQ1750AllPXHMMxO51w
DDFozy9ga3/i6/u2wDOh6rCj+9YwKXedT/v5GXxg0QhNFOmcuZQBTshiDY/TmMwb
JtfxC2g8tXD3GvehPmAl+UeW52rzpPt089rxRUFA2Z+yTiGR/Y/NLmuyiSqFEgjk
XizK6z2YI18sJ6ki+Xxn7XpKj7CY+NywDIqPafLBzALdwYWUw97SRg+dbs0B0Wdb
Qbo1uGRvZR8lFi8jS7vSIPVkRyKM4Vi3JpsAMujhfdEufTZ94XFGLlE8NYrjg8f3
Xgjz8JIs5j/Jm4nI3CzrMsG8BAXj+Y9M331BXUYOJxX/UKpoCeXTg3bvWV6Vo6I5
jYY1lAeccaSngSd2zTB57F/jqPBmjuS087a49uijZv3n+w3C/wvzeol8+q9Oi0Fj
FlatfTl1+4zThPKBJsW1c6mn1lhRn1YT24hFG/hjAHPxo9VCeBCfzlFbpDV6uMCq
fSXEPE6/bwTO4fiNQE+pF1OLAre8WiMgScO/pFh0sloby512tYNCU/yTOZcDRAkV
XYAyZeTvzjMmmos1HAGP
=ppWt
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVpMWin6ZAP0PgtI9AQKP8A/9FJIFrMVy7kq+PeSy2EHFDoyoHZ2nk1Kf
mLArEVC4/iqbQq2Q/a24fsSFJBq8IOFZOP1KEEMYd6pK9pqTa8wovyDXbpi76NT/
qZUQ4TG/cf0oGMfqFZ4mi5pwsr1ltnHfDuPonYyI3h1AKAy8Q78DOS04OcMiqHJV
jtNeJBdEkAOpjpRzndxcPO3kVRkWE8TeFr5cBDak/SpKv01pUENn05CbQAMTGLOL
MGp0aiEZuqWe7wNYwCAaQ1VtBH/MySqXNvygx+W1S3CCm2q60UgKdtEdLhM3paL3
Kttvkr0Iaijwh0xq/2OKhAzJ+XcjLsvidNbMoQeN1Qx7a21/ZKg6sBY/wZYZrs+p
PgF6d5EGa+CvcAkQsb1JFVACN3P7bi1Kv3AfKUJU/d0mWD1Kk3guulK/IugxChpt
TVH9jMLDR6T+lBVzEWdhgpbFFJpx1E1hAlPYwr2Yc0mfIdjCSkNiAGHv24Z3buO9
opR1PhV3OS02ZkHnADsQnCKtuEIWl0IAcftHGxeohp8mhsODJmzti3IOLCLwIkDk
WwYr8FELxJ5dJ2KsmLTg2wg4oYROBGdW1nv46d6SOUkBlbMZLD8CXiRHxoOz5MXl
jBEoRvVbWd04Ye0azCCY+RV4YsMSKTfL1/WryV9Be06PvRWknd/CVwyuVnuocerG
dgpgAXgW7RY=
=i1pm
-----END PGP SIGNATURE-----