ByteOS Network

Source-security@debian.org

Published At-11 Apr, 2014 | 01:55

Updated At-12 Apr, 2025 | 10:46

plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C

Type: Primary

Version: 2.0

Base score: 7.8

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:N/I:N/A:C

CPE Matches

lightwitch>>metronome>>Versions up to 3.4(inclusive)

cpe:2.3:a:lightwitch:metronome:*:*:*:*:*:*:*:*

prosody>>prosody>>Versions up to 0.9.3(inclusive)

cpe:2.3:a:prosody:prosody:*:*:*:*:*:*:*:*

prosody>>prosody>>0.1.0

cpe:2.3:a:prosody:prosody:0.1.0:*:*:*:*:*:*:*

prosody>>prosody>>0.2.0

cpe:2.3:a:prosody:prosody:0.2.0:*:*:*:*:*:*:*

prosody>>prosody>>0.3.0

cpe:2.3:a:prosody:prosody:0.3.0:*:*:*:*:*:*:*

prosody>>prosody>>0.4.0

cpe:2.3:a:prosody:prosody:0.4.0:*:*:*:*:*:*:*

prosody>>prosody>>0.4.1

cpe:2.3:a:prosody:prosody:0.4.1:*:*:*:*:*:*:*

prosody>>prosody>>0.4.2

cpe:2.3:a:prosody:prosody:0.4.2:*:*:*:*:*:*:*

prosody>>prosody>>0.5.0

cpe:2.3:a:prosody:prosody:0.5.0:*:*:*:*:*:*:*

prosody>>prosody>>0.5.1

cpe:2.3:a:prosody:prosody:0.5.1:*:*:*:*:*:*:*

prosody>>prosody>>0.5.2

cpe:2.3:a:prosody:prosody:0.5.2:*:*:*:*:*:*:*

prosody>>prosody>>0.6.0

cpe:2.3:a:prosody:prosody:0.6.0:*:*:*:*:*:*:*

prosody>>prosody>>0.6.1

cpe:2.3:a:prosody:prosody:0.6.1:*:*:*:*:*:*:*

prosody>>prosody>>0.6.2

cpe:2.3:a:prosody:prosody:0.6.2:*:*:*:*:*:*:*

prosody>>prosody>>0.7.0

cpe:2.3:a:prosody:prosody:0.7.0:*:*:*:*:*:*:*

prosody>>prosody>>0.8.0

cpe:2.3:a:prosody:prosody:0.8.0:*:*:*:*:*:*:*

prosody>>prosody>>0.8.1

cpe:2.3:a:prosody:prosody:0.8.1:*:*:*:*:*:*:*

prosody>>prosody>>0.8.2

cpe:2.3:a:prosody:prosody:0.8.2:*:*:*:*:*:*:*

prosody>>prosody>>0.9.0

cpe:2.3:a:prosody:prosody:0.9.0:*:*:*:*:*:*:*

prosody>>prosody>>0.9.1

cpe:2.3:a:prosody:prosody:0.9.1:*:*:*:*:*:*:*

prosody>>prosody>>0.9.2

cpe:2.3:a:prosody:prosody:0.9.2:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	nvd@nist.gov

CWE ID: CWE-20

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://blog.prosody.im/prosody-0-9-4-released/	security@debian.org	Vendor Advisory
http://code.lightwitch.org/metronome/rev/49f47277a411	security@debian.org	Exploit Patch
http://hg.prosody.im/0.9/rev/b3b1c9da38fb	security@debian.org	Exploit Patch
http://openwall.com/lists/oss-security/2014/04/07/7	security@debian.org	N/A
http://openwall.com/lists/oss-security/2014/04/09/1	security@debian.org	N/A
http://secunia.com/advisories/57710	security@debian.org	N/A
http://www.debian.org/security/2014/dsa-2895	security@debian.org	N/A
http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/	security@debian.org	N/A
http://blog.prosody.im/prosody-0-9-4-released/	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://code.lightwitch.org/metronome/rev/49f47277a411	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch
http://hg.prosody.im/0.9/rev/b3b1c9da38fb	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch
http://openwall.com/lists/oss-security/2014/04/07/7	af854a3a-2127-422b-91ae-364da2661108	N/A
http://openwall.com/lists/oss-security/2014/04/09/1	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/57710	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.debian.org/security/2014/dsa-2895	af854a3a-2127-422b-91ae-364da2661108	N/A
http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/	af854a3a-2127-422b-91ae-364da2661108	N/A