« Volver al listado

CVE-2016-1232

Estado: ModificadaAlta (7.5)—

El módulo mod_dialback en Prosody en versiones anteriores a 0.9.9 no genera adecuadamente valores aleatorios para para el token secreto en la autenticación de devolución de llamada de servidor a servidor, lo que hace que sea más fácil para atacantes suplantar servidores a través de un ataque de fuerza bruta.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Debian — Debian LinuxFedoraproject — FedoraProsody — Prosody

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-1232",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-01-12T20:59:10.200",
  "references": [
    {
      "url": "http://blog.prosody.im/prosody-0-9-9-security-release/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175829.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175868.html",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.debian.org/security/2016/dsa-3439",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2016/01/08/5",
      "source": "security@debian.org"
    },
    {
      "url": "https://prosody.im/issues/issue/571",
      "source": "security@debian.org"
    },
    {
      "url": "https://prosody.im/security/advisory_20160108-2/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://blog.prosody.im/prosody-0-9-9-security-release/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175829.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175868.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2016/dsa-3439",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2016/01/08/5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://prosody.im/issues/issue/571",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://prosody.im/security/advisory_20160108-2/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack."
    },
    {
      "lang": "es",
      "value": "El módulo mod_dialback en Prosody en versiones anteriores a 0.9.9 no genera adecuadamente valores aleatorios para para el token secreto en la autenticación de devolución de llamada de servidor a servidor, lo que hace que sea más fácil para atacantes suplantar servidores a través de un ataque de fuerza bruta."
    }
  ],
  "lastModified": "2026-06-17T00:41:31.127",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:prosody:prosody:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83032BB7-AE53-4E17-90F1-5BA84367BC23",
              "versionEndIncluding": "0.9.8"
            },
            {
              "criteria": "cpe:2.3:a:prosody:prosody:0.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69BF8C97-A90B-4F1D-9300-F8BF411BDF69"
            },
            {
              "criteria": "cpe:2.3:a:prosody:prosody:0.9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B70430C5-9AA2-46D5-B7DD-ED08CB980F47"
            },
            {
              "criteria": "cpe:2.3:a:prosody:prosody:0.9.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19FFAE24-10BB-4F88-A0BF-105B4B6A702D"
            },
            {
              "criteria": "cpe:2.3:a:prosody:prosody:0.9.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "668FF630-38DC-44BF-ACC8-2F519B788175"
            },
            {
              "criteria": "cpe:2.3:a:prosody:prosody:0.9.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DADDF029-1D55-4B48-B535-BBF677B10C29"
            },
            {
              "criteria": "cpe:2.3:a:prosody:prosody:0.9.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB07BA0E-AA91-4773-AC6C-63C825D6D114"
            },
            {
              "criteria": "cpe:2.3:a:prosody:prosody:0.9.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6E8D0F2-485E-441A-94F5-5FEF084B38F8"
            },
            {
              "criteria": "cpe:2.3:a:prosody:prosody:0.9.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2251303-150D-439D-9AE3-A0B61379A0B4"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"https://cwe.mitre.org/data/definitions/338.html\">CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)</a>",
  "sourceIdentifier": "security@debian.org"
}