PT-2021-2343 · Cisco · Cisco Jabber For Windows+2

Olav Sortland Thoresen · Published 2021-03-24 · Updated 2021-03-29 · CVE-2021-1411

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows (affected versions not specified) Cisco Jabber for MacOS (affected versions not specified) Cisco Jabber for mobile platforms (affected versions not specified)

Description The issue allows an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. The vulnerability is related to insufficient input validation in Cisco Jabber for Windows, which can be exploited by a remote attacker sending a specially crafted XMPP message to execute arbitrary code.

Recommendations For Cisco Jabber for Windows, consider disabling the XMPP messaging functionality until a patch is available. For Cisco Jabber for MacOS and Cisco Jabber for mobile platforms, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

CWE-170

Related Identifiers

BDU:2021-01580

CVE-2021-1411

Affected Products

Cisco Jabber For Macos

Cisco Jabber For Windows

Cisco Jabber For Mobile Platforms

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1411 · Security Note
• https://bdu.fstec.ru/vul/2021-01580 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021032514 · Note