Cisco Jabber Vulnerabilities

THE THREAT

On September 2nd, 2020, Cisco announced a series of high impact vulnerabilities affecting the Cisco Jabber video conferencing platform [1]. The most serious vulnerability is CVE-2020-3495, which allows for arbitrary code execution. To exploit CVE-2020-3495 an attacker would need sufficient access to send messages to Jabber clients. This vulnerability is considered wormable, meaning that an exploit could be created to automatically spread malicious content to other vulnerable systems.

Organizations are encouraged to apply security patches after performing a business impact review.

What we’re doing about it

• MVS will automatically add the relevant checks once they are made available
• eSentire security teams are evaluating detection methods

What you should do about it

• After performing a business impact review, apply the official Cisco security updates

Additional information

The vulnerability stems from improper validation of message contents. In an attack scenario, a threat actor who has already achieved initial access could send a maliciously crafted Extensible Messaging and Presence Protocol (XMPP) message to internal Jabber users. After receiving the message, no user interaction is required.

CVE-2020-3495 affects versions 12.1 – 12.9 of the Jabber client for Windows. Exploitation of the vulnerability has not been identified in the wild at this time.

Additional Cisco Jabber Vulnerabilities:

• CVE-2020-3430 - Command injection vulnerability that could allow a remote and unauthenticated threat actor to execute arbitrary commands
• CVE-2020-3498 - Windows information disclosure vulnerability due to improper validation that could result in the loss of sensitive information
• CVE-2020-3537 - Universal Naming Convention (UNC) link handling vulnerability that can be exploited to allow a remote and unauthenticated threat actor to gain access to sensitive information

References:

[1] https://watchcom.no/nyheter/nyhetsarkiv/uncovers-cisco-jabber-vulnerabilities/