UBUNTU-CVE-2020-8086: Critical severity ubuntu/prosody-modules vulnerability
The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin() function. This grants remote entities admin-only functionality if their username matches the username of a local admin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/prosody-modulesto a version that resolves this vulnerability.Fixed in 0.0~hg20150813.12ac88940fe3-2ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/prosody-modulesto a version that resolves this vulnerability.Fixed in 0.0~hg20170929.c53cc1ae4788+dfsg-3ubuntu0.1~esm1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Prosody deployments using the mod_auth_ldap or mod_auth_ldap2 Community Modules are exposed. The affected modules are identified as versions through 2020-01-27.
What does an attacker need to exploit it?
An attacker can exploit the issue remotely without authentication or user interaction. Their username must match the username of a local administrator.
What access can successful exploitation provide?
A successful attacker can obtain functionality restricted to administrators. The vulnerability is rated critical with impacts to confidentiality, integrity, and availability.
How can I tell whether my deployment is affected?
Check whether the Prosody installation uses mod_auth_ldap or mod_auth_ldap2 and whether remote entities can have usernames matching local administrator usernames. Deployments not using these Community Modules are not identified by the provided data as affected.