PT-2021-2369 · Cisco · Cisco Jabber For Windows+2

Olav Sortland Thoresen · Published 2021-03-24 · Updated 2022-10-29 · CVE-2021-1417

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows (affected versions not specified) Cisco Jabber for MacOS (affected versions not specified) Cisco Jabber for mobile platforms (affected versions not specified)

Description The issue is related to insufficient input validation in the Cisco Jabber platform, which could allow a remote attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. This can be achieved by sending a specially crafted XMPP message.

Recommendations For Cisco Jabber for Windows, consider restricting access to sensitive information and network traffic until a fix is available. For Cisco Jabber for MacOS, avoid using the platform for sensitive operations until the issue is resolved. For Cisco Jabber for mobile platforms, restrict the use of the platform to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-201

CWE-170

Related Identifiers

BDU:2021-01609

CVE-2021-1417

Affected Products

Cisco Jabber For Macos

Cisco Jabber For Windows

Cisco Jabber For Mobile Platforms

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1417 · Security Note
• https://bdu.fstec.ru/vul/2021-01609 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021032514 · Note