CVE-2012-3525

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

• CWE-20

• http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
• http://rhn.redhat.com/errata/RHSA-2012-1538.html
• http://rhn.redhat.com/errata/RHSA-2012-1539.html
• http://secunia.com/advisories/50124Vendor Advisory
• http://secunia.com/advisories/50859
• http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01903.html
• http://www.openwall.com/lists/oss-security/2012/08/22/5
• http://www.openwall.com/lists/oss-security/2012/08/22/6
• http://www.securityfocus.com/bid/55167
• http://xmpp.org/resources/security-notices/server-dialback/Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=850872
• https://github.com/Jabberd2/jabberd2/commit/aabcffae560d5fd00cd1d2ffce5d760353cf0a4dExploit, Patch
• http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
• http://rhn.redhat.com/errata/RHSA-2012-1538.html
• http://rhn.redhat.com/errata/RHSA-2012-1539.html
• http://secunia.com/advisories/50124Vendor Advisory
• http://secunia.com/advisories/50859
• http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01903.html
• http://www.openwall.com/lists/oss-security/2012/08/22/5
• http://www.openwall.com/lists/oss-security/2012/08/22/6
• http://www.securityfocus.com/bid/55167
• http://xmpp.org/resources/security-notices/server-dialback/Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=850872
• https://github.com/Jabberd2/jabberd2/commit/aabcffae560d5fd00cd1d2ffce5d760353cf0a4dExploit, Patch

Published

Aug 25, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-3519routerlist.c in Tor before 0.2.2.38 uses a different amount …
• CVE-2012-3520The Netlink implementation in the Linux kernel before 3.2.30…
• CVE-2012-3521Multiple directory traversal vulnerabilities in the cssgen c…
• CVE-2012-3522Cross-site scripting (XSS) vulnerability in contrib/langwiz.…
• CVE-2012-3523The STARTTLS implementation in nnrpd in INN before 2.5.3 doe…
• CVE-2012-3524libdbus 1.5.x and earlier, when used in setuid or other priv…
• CVE-2012-3526The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 …
• CVE-2012-3527view_help.php in the backend help system in TYPO3 4.5.x befo…
• CVE-2012-3528Multiple cross-site scripting (XSS) vulnerabilities in the b…
• CVE-2012-3529The configuration module in the backend in TYPO3 4.5.x befor…
• CVE-2012-3530Incomplete blacklist vulnerability in the t3lib_div::quoteJS…
• CVE-2012-3531Cross-site scripting (XSS) vulnerability in the Install Tool…