PT-2017-12527 · Cisco · Cisco Jabber For Windows

Publicado 2017-11-30 · Atualizado 2019-10-09 · CVE-2017-12361

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows (affected versions not specified)

Description A vulnerability in Cisco Jabber for Windows could allow an unauthenticated, local attacker to access sensitive communications made by the Jabber client. The issue arises from the way Cisco Jabber for Windows handles random number generation for file folders. An attacker could exploit this by fixing the random number data used to establish Secure Sockets Layer (SSL) connections between clients, potentially allowing them to decrypt secure communications made by the Cisco Jabber for Windows client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-200

CWE-330

Identificadores relacionados

CVE-2017-12361

Produtos afetados

Cisco Jabber For Windows

Referências · 5

• http://securitytracker.com/id/1039915 · Nota
• http://securityfocus.com/bid/101994 · Nota
• https://osv.dev/vulnerability/CVE-2017-12361 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-jabber2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12361 · Nota de Segurança