PT-2021-2344 · Cisco · Cisco Jabber For Windows+2

Olav Sortland Thoresen · Published 2021-03-24 · Updated 2021-03-29 · CVE-2021-1418

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows (affected versions not specified) Cisco Jabber for MacOS (affected versions not specified) Cisco Jabber for mobile platforms (affected versions not specified)

Description The issue allows an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. The vulnerability is related to insufficient input validation, which can be exploited by sending specially crafted XMPP messages, potentially leading to a denial of service condition.

Recommendations For Cisco Jabber for Windows, consider restricting the processing of XMPP messages until a fix is available. For Cisco Jabber for MacOS, avoid using the platform until a patch is released. For Cisco Jabber for mobile platforms, restrict access to the platform to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

CWE-170

Related Identifiers

BDU:2021-01581

CVE-2021-1418

Affected Products

Cisco Jabber For Macos

Cisco Jabber For Windows

Cisco Jabber For Mobile Platforms

References · 5

• https://bdu.fstec.ru/vul/2021-01581 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1418 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1418 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021032514 · Note