prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.

The remote Ubuntu 18.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-4834-1 advisory.

    It was discovered that Prosody incorrectly validated the virtual host associated with a user session     across stream restarts. A remote attacker

    could use this issue to gain unintended access to resources.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for prosody to version 0.10.2 fixes the following issues :

This security issue was fixed :

  - CVE-2018-10847: Prevent insufficient validation of     client-provided parameters during XMPP stream restarts.
    Authenticated users may have overriden the realm     associated with their session, potentially bypassing     security policies and allowing impersonation     (bsc#1094890).

These non-security issues were fixed :

  - mod_websocket: Store the request object on the session     for use by other modules

  - mod_c2s: Avoid concatenating potential nil value

  - core.certmanager: Allow all non-whitespace in service     name

  - mod_disco: Skip code specific to disco on user accounts 

  - mod_bosh: Store the normalized hostname on session

  - MUC: Fix error logged when no persistent rooms present

Prosody 0.10.2 ==============

See upstream's blog post at https://blog.prosody.im/prosody-0-10-2-security-release/ for a full overview of the release changes.

Prosody 0.10.2 fixes a cross-host authentication vulnerability, CVE-2018-10847. The issue affects Prosody instances that have multiple virtual hosts (including anonymous authenticated hosts). All versions of Prosody before 0.9.14 and 0.10.2 are affected. A full security advisory is available at https://prosody.im/security/advisory_20180531

Security

--------

  - mod_c2s: Do not allow the stream &lsquo;to&rsquo; to     change across stream restarts (fixes #1147)

Minor changes

-------------

  - mod_websocket: Store the request object on the session     for use by other modules (fixes #1153)

  - mod_c2s: Avoid concatenating potential nil value (fixes     #753)

  - core.certmanager: Allow all non-whitespace in service     name (fixes #1019)

  - mod_disco: Skip code specific to disco on user accounts     (avoids invoking usermanager, fixes #1150)

  - mod_bosh: Store the normalized hostname on session     (fixes #1151)

  - MUC: Fix error logged when no persistent rooms present     (fixes #1154)

Dowstream

----------

  - Changed log rotation from weekly/52 to local system     defaults

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for prosody fixes the following issues :

This security issue was fixed :

  - CVE-2018-10847: Prevent insufficient validation of     client-provided parameters during XMPP stream restarts.
    Authenticated users may have overriden the realm     associated with their session, potentially bypassing     security policies and allowing impersonation     (bsc#1094890).

It was discovered that Prosody, a lightweight Jabber/XMPP server, does not properly validate client-provided parameters during XMPP stream restarts, allowing authenticated users to override the realm associated with their session, potentially bypassing security policies and allowing impersonation.

Details can be found in the upstream advisory at https://prosody.im/security/advisory_20180531/

ID	Name	Product	Family	Severity
183110	Ubuntu 18.04 ESM : Prosody vulnerability (USN-4834-1)	Nessus	Ubuntu Local Security Checks	high
123179	openSUSE Security Update : prosody (openSUSE-2019-414)	Nessus	SuSE Local Security Checks	high
120258	Fedora 28 : prosody (2018-18f8c6ce79)	Nessus	Fedora Local Security Checks	high
110472	openSUSE Security Update : prosody (openSUSE-2018-597)	Nessus	SuSE Local Security Checks	high
110436	openSUSE Security Update : prosody (openSUSE-2018-596)	Nessus	SuSE Local Security Checks	high
110426	Fedora 27 : prosody (2018-455803056d)	Nessus	Fedora Local Security Checks	high
110317	Debian DSA-4216-1 : prosody - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10847

high

Tenable Plugins

high

high

high

high

high

high

high