Improper input validation in Lightwitch Metronome
CVE-2014-2744
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.8 (High). Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.033 (88.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 88.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.033 · newest: 0.033 · change: 0.000
Affected products
- Lightwitch Metronome
- Prosody — versions 0.1.0, 0.2.0, 0.3.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-high…
- www.debian.org/security/2014/dsa-2895 (vendor-advisory)
- secunia.com/advisories/57710 (third-party-advisory)
- code.lightwitch.org/metronome/rev/49f47277a411 (Exploit, Patch)
- blog.prosody.im/prosody-0-9-4-released/ (Vendor Advisory)
- hg.prosody.im/0.9/rev/b3b1c9da38fb (Exploit, Patch)
- openwall.com/lists/oss-security/2014/04/09/1 (mailing-list)
- openwall.com/lists/oss-security/2014/04/07/7 (mailing-list)
Frequently asked questions
- What is CVE-2014-2744?
- CVE-2014-2744 is a vulnerability in Lightwitch Metronome, classified under Improper Input Validation. Published 2014-04-11.
- Is CVE-2014-2744 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.