#YOUTUBE CISCO JABBER FOR WINDOWS HOW TO#
#YOUTUBE CISCO JABBER FOR WINDOWS SOFTWARE#

exe file and force the victim to accept it using an XSS attack,” then executing the malicious file on a targeted victim’s machine.Īlso read: How To Make A PDPC Complaint: With Its Importance And Impact “Since Cisco Jabber supports file transfers, an attacker can initiate a file transfer containing a malicious.

“The executable would run on the end-user system with the privileges of the user who initiated the Cisco Jabber client application.”Īs Watchcom’s Olav Sortland Thoresen explains in a report with more details on CVE-2020-3495, attackers can also automate the exploitation process to create a worm capable of spreading automatically to new devices. “As a result of exploitation, an attacker could cause the application to run an arbitrary executable that already exists within the local file path of the application,” Cisco added. “A successful exploit could allow the attacker to cause the application to execute arbitrary programs on the targeted system with the privileges of the user account that is running the Cisco Jabber client software, possibly resulting in arbitrary code execution,” Cisco explains.Īttackers are required to have access to their victims’ XMPP domains to send the malicious XMPP messages needed to successfully exploit the vulnerability.

No user interaction is required to exploit this flaw, with CVE-2020-3495 also being exploitable when the Jabber for Windows client is running in the background.

#YOUTUBE CISCO JABBER FOR WINDOWS SOFTWARE#

The security flaw tracked as CVE-2020-3495 received an almost maximum 9.9 CVSS base score from Cisco and it is caused by improper input validation of incoming messages’ contents.ĬVE-2020-3495 can allow authenticated, remote attackers to execute arbitrary code on systems running unpatched Jabber for Windows software after successful exploitation using maliciously-crafted Extensible Messaging and Presence Protocol (XMPP) messages. The vulnerability was found and reported by Olav Sortland Thoresen of Watchcom. The Cisco Product Security Incident Response Team (PSIRT) says that the flaw is not currently exploited in the wild. Cisco Fixes Critical Code Execution Bug In Jabber For WindowsĬisco today addressed a critical severity remote code execution vulnerability affecting multiple versions of its Cisco Jabber for Windows software.Ĭisco Jabber for Windows is a desktop collaboration app designed to provide users with presence, instant messaging (IM), cloud messaging, desktop sharing, as well as audio, video, and web conferencing.

Youtube cisco jabber for windows