PT-2011-4370 · Cisco · Cisco Jabber Extensible Communications Platform

Publicado 2011-10-06 · Atualizado 2012-05-14 · CVE-2011-3287

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Jabber Extensible Communications Platform (aka Jabber XCP) versions 2.x through 5.4.x before 5.4.0.27581 Cisco Jabber Extensible Communications Platform (aka Jabber XCP) versions 5.8.x before 5.8.1.27561

Description The issue is related to improper detection of recursion during entity expansion, allowing remote attackers to cause a denial of service. This can be achieved by sending a crafted XML document containing a large number of nested entity references, leading to memory and CPU consumption, and process crash.

Recommendations For versions 2.x through 5.4.x before 5.4.0.27581, update to version 5.4.0.27581 or later. For versions 5.8.x before 5.8.1.27561, update to version 5.8.1.27561 or later.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2011-3287

Produtos afetados

Cisco Jabber Extensible Communications Platform

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2011-3287 · Nota de Segurança
• http://cisco.com/en/US/products/products_security_advisory09186a0080b95d47.shtml · Aviso do Fabricante