High severity7.5NVD Advisory· Published Jan 12, 2016· Updated May 6, 2026
CVE-2016-1232
CVE-2016-1232
Description
The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.
Affected products
13cpe:2.3:a:prosody:prosody:*:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:prosody:prosody:*:*:*:*:*:*:*:*range: <=0.9.8
- cpe:2.3:a:prosody:prosody:0.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:prosody:prosody:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:prosody:prosody:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:prosody:prosody:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:prosody:prosody:0.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:prosody:prosody:0.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:prosody:prosody:0.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:prosody:prosody:0.9.7:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- blog.prosody.im/prosody-0-9-9-security-release/nvdPatchVendor Advisory
- prosody.im/security/advisory_20160108-2/nvdVendor Advisory
- lists.fedoraproject.org/pipermail/package-announce/2016-January/175829.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2016-January/175868.htmlnvd
- www.debian.org/security/2016/dsa-3439nvd
- www.openwall.com/lists/oss-security/2016/01/08/5nvd
- prosody.im/issues/issue/571nvd
News mentions
0No linked articles in our index yet.