PT-2011-4370 · Cisco · Cisco Jabber Extensible Communications Platform
Published
2011-10-06
·
Updated
2012-05-14
·
CVE-2011-3287
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco Jabber Extensible Communications Platform (aka Jabber XCP) versions 2.x through 5.4.x before 5.4.0.27581
Cisco Jabber Extensible Communications Platform (aka Jabber XCP) versions 5.8.x before 5.8.1.27561
Description
The issue is related to improper detection of recursion during entity expansion, allowing remote attackers to cause a denial of service. This can be achieved by sending a crafted XML document containing a large number of nested entity references, leading to memory and CPU consumption, and process crash.
Recommendations
For versions 2.x through 5.4.x before 5.4.0.27581, update to version 5.4.0.27581 or later.
For versions 5.8.x before 5.8.1.27561, update to version 5.8.1.27561 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Jabber Extensible Communications Platform