Cisco Jabber for Windows DLL Preloading Vulnerability (cisco-sa-20190703-jabber-dll)

high Nessus Plugin ID 126642

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

According to its self-reported version, Cisco Jabber for Windows is affected by a vulnerability in the loading mechanism of specific dynamic link libraries due to insufficient validation of the resources loaded by the application at run time. An authenticated, local attacker can exploit this to perform a DLL preloading attack by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the Jabber application launches. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user's account.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCvo55994, CSCvo63008

Plugin Details

Severity: High

ID: 126642

File Name: cisco-sa-20190703-jabber-dll.nasl

Version: 1.9

Type: local

Agent: windows

Family: Windows

Published: 7/12/2019

Updated: 2/5/2021

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2019-1855

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:jabber

Required KB Items: installed_sw/Cisco Jabber for Windows

Exploit Ease: No known exploits are available

Patch Publication Date: 7/3/2019

Vulnerability Publication Date: 7/3/2019

Reference Information

CVE: CVE-2019-1855

CWE: 264

CISCO-SA: cisco-sa-20190703-jabber-dll

IAVB: 2019-B-0055-S

CISCO-BUG-ID: CSCvo55994, CSCvo63008

Detections

Analytics