PT-2017-12527 · Cisco · Cisco Jabber For Windows

Published 2017-11-30 · Updated 2019-10-09 · CVE-2017-12361

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows (affected versions not specified)

Description A vulnerability in Cisco Jabber for Windows could allow an unauthenticated, local attacker to access sensitive communications made by the Jabber client. The issue arises from the way Cisco Jabber for Windows handles random number generation for file folders. An attacker could exploit this by fixing the random number data used to establish Secure Sockets Layer (SSL) connections between clients, potentially allowing them to decrypt secure communications made by the Cisco Jabber for Windows client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Use of Insufficiently Random Values

Weakness Enumeration

CWE-200

CWE-330

Related Identifiers

CVE-2017-12361

Affected Products

Cisco Jabber For Windows

References · 5

• https://osv.dev/vulnerability/CVE-2017-12361 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-jabber2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12361 · Security Note
• http://securitytracker.com/id/1039915 · Note
• http://securityfocus.com/bid/101994 · Note