[JDEV] Something up with jabber.org?

[Jacek Konieczny]

On Tue, Jul 29, 2003 at 05:47:32PM +0200, Mikael Hallendal wrote:
> Hi!
> 
> I got some reports from people having problems connecting to jabber.org
> with Gossip and when trying it out I got this:
> 
> Sent:
> <iq id="msg_4" type="get">  
>   <query xmlns="jabber:iq:auth"> 
>     <username>hallski</username>
>   </query>
> </iq>

This is invalid query (no resource) so you should get an error reply.


> Recv:
> 
> <iq type='error' id='keh_1331'>
>   <query xmlns='jabber:iq:auth'>
>     <username>XXXXX XXXXXX</username>
>   </query>
>   <error code='406'>Not Acceptable</error>
> </iq>
> 
> Where the XXX part is a name I've never seen before.
> 
> Looks like I got a message that was routed to another user, if so, that 
> looks like a serious bug in the jabberd.

Yes - this seems a serious and probably security bug.

Greets,
        Jacek