Wormable code-execution flaw in Cisco Jabber has a severity rating of 9.9 out of 10
The company failed to adequately fix the vulnerability before, so it’s trying again. …
reader comments
60 with 40 posters participating
Cisco has patched its Jabber conferencing and messaging application against a critical vulnerability that made it possible for attackers to execute malicious code that would spread from computer to computer with no user interaction required. Again.
The vulnerability, which was first disclosed in September, was the result of several flaws discovered by researchers at security firm Watchcom Security. First, the app failed to properly filter potentially malicious elements contained in user-sent messages. The filter was based on an incomplete blocklist that could be bypassed using a programming attribute known as onanimationstart.
Messages that contained the attribute passed directly to DOM of an embedded browser. Because the browser was based on the Chromium Embedded Framework, it would execute any scripts that made it through the filter.
With the filter bypassed, the researchers still had to find a way to break out of a security sandbox that’s designed to keep user input from reaching sensitive parts of the operating system. The researchers eventually settled on a function called CallCppFunction, which among other things Cisco Jabber uses to open files one user receives from another.
In all, Watchcom reported four vulnerabilities, all of which received patches at the same time they were disclosed in September. On Thursday, however, the Watchcom researchers said fixes for three of them were incomplete.
blog post, company researchers wrote:
Two of the vulnerabilities are caused by the ability to inject custom HTML tags into XMPP messages. The patch released in September only patched the
Continue reading – Article source
Similar Posts:
