Cisco fixes critical code execution bug in Jabber for Windows

guest · Sep 2, 2020

Cisco fixes critical code execution bug in Jabber for Windows
September 2, 2020
https://www.bleepingcomputer.com/ne...cal-code-execution-bug-in-jabber-for-windows/

Cisco today addressed a critical severity remote code execution vulnerability affecting multiple versions of its Cisco Jabber for Windows software.

Cisco Jabber for Windows is a desktop collaboration app designed to provide users with presence, instant messaging (IM), cloud messaging, desktop sharing, as well as audio, video, and web conferencing.
The vulnerability was found and reported by Olav Sortland Thoresen of Watchcom. The Cisco Product Security Incident Response Team (PSIRT) says that the flaw is not currently exploited in the wild.
Click to expand...

Exploitation via malicious XMPP messages
The security flaw tracked as CVE-2020-3495 received an almost maximum 9.9 CVSS base score from Cisco and it is caused by improper input validation of incoming messages' contents.

CVE-2020-3495 can allow authenticated, remote attackers to execute arbitrary code on systems running unpatched Jabber for Windows software after successful exploitation using maliciously-crafted Extensible Messaging and Presence Protocol (XMPP) messages.

"A successful exploit could allow the attacker to cause the application to execute arbitrary programs on the targeted system with the privileges of the user account that is running the Cisco Jabber client software, possibly resulting in arbitrary code execution," Cisco explains.
Click to expand...

Vulnerable Jabber for Windows systems
The vulnerability does not impact Cisco Jabber for macOS or mobile platforms, and it only affects the Windows releases listed in the table embedded below.
Click to expand...

guest · Dec 10, 2020

Cisco fixes new Jabber for Windows critical code execution bug
December 10, 2020
https://www.bleepingcomputer.com/ne...bber-for-windows-critical-code-execution-bug/

Cisco has addressed a new critical severity remote code execution (RCE) vulnerability affecting several versions of Cisco Jabber for Windows, macOS, and mobile platforms after patching a related security bug in September.
RCE stemming from insufficient mitigation
Cisco released security updates in September to address a critical RCE security vulnerability tracked as CVE-2020-3495 stemming from a Cross-Site Scripting (XSS) bug in Cisco Jabber.

Since then, a new wormable RCE vulnerability was found by researchers at Watchcom who reported CVE-2020-3495 to Cisco after checking if the September patch fully mitigated CVE-2020-3495.

"During this audit, we discovered that the most severe vulnerabilities, including the RCE vulnerability, have not been properly mitigated and that users remain vulnerable," Watchcom says.
Click to expand...

"Patches are now available and we urge all Cisco Jabber users to update as soon as possible!"

In all, the researchers reported four Cisco Jabber client vulnerabilities in September and, as they found, three of them were not insufficiently mitigated by Cisco's patches.
This allowed them to spot new vulnerabilities that could be abused to exploit all currently supported Cisco Jabber versions, from 12.1 up to 12.9.
Click to expand...

Watchcom: Watchcom discovers new Cisco Jabber vulnerabilities

The three vulnerabilities have been assigned new CVE numbers to distinguish them from the vulnerabilities disclosed in September. The new CVE numbers and the corresponding CVSS scores are listed below:

CVE-2020-26085: Cisco Jabber Cross-Site Scripting leading to RCE (CVSS 9.9)

CVE-2020-27132: Cisco Jabber Password Hash Stealing Information Disclosure (CVSS 6.5)

CVE-2020-2020-27127: Cisco Jabber Custom Protocol Handler Command Injection (CVSS 4.3)

Click to expand...

guest · Dec 11, 2020

Cisco Releases Security Updates for Jabber Desktop and Mobile Client Software
December 11, 2020
https://us-cert.cisa.gov/ncas/curre...rity-updates-jabber-desktop-and-mobile-client

Cisco has released security updates to address vulnerabilities in Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review Cisco Security Advisory cisco-sa-jabber-ZktzjpgO and apply the necessary updates.
Click to expand...

Log in or Sign up

Cisco fixes critical code execution bug in Jabber for Windows

guest Guest

guest Guest

guest Guest

Log in or Sign up

Cisco fixes critical code execution bug in Jabber for Windows

guest Guest

guest Guest

guest Guest

Useful Searches