Vulnerability identifier: #VU54206
Vulnerability risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-522
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Cisco Jabber for Windows
Client/Desktop applications /
Messaging software
Cisco Jabber for MacOS
Client/Desktop applications /
Messaging software
Cisco Jabber for Android and iOS
Client/Desktop applications /
Messaging software
Vendor:
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or gain access to sensitive information.
The vulnerability exists due to improper input validation when processing messages. A remote authenticated attacker can send a specially crafted Extensible Messaging and Presence Protocol (XMPP) message to the affected application and gain access to return sensitive authentication information to another system, which the attacker could use in further attacks.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-GuC5mLwG
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCvy20799
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.